Incorrect default for Filebeat logging.files.keepfiles

Elastic Stack Beats
1

The documented default value for Filebeat's logging.files.keepfiles is 7, but in my testing this doesn't seem to be accurate. The actual default seems to be 0, meaning Filebeat doesn't keep any rotated log files.

How to reproduce:

  1. Install filebeat (I'm running 6.3.0 on Ubuntu 14.04 from the Elastic Apt repository).
  2. Confirm that /etc/filebeat/filebeat.yml does not define any value for logging.files.keepfiles.
  3. Start the service: service filebeat start.
  4. Confirm that a log file is created at /var/log/filebeat/filebeat.
  5. Restart the service: service filebeat restart, triggering a log rotate.
  6. Confirm that the previous log file was overwritten when it should have been rotated: only one file exists under /var/log/filebeat.
  7. Explicitly set logging.files.keepfiles: 7 in /etc/filebeat/filebeat.yml.
  8. Restart the service: service filebeat restart, triggering another log rotate.
  9. Confirm that the previous log file was rotated correctly, and now exists at /var/log/filebeat/filebeat.1.

I've searched but can't find any previous reports of this bug. Should I file an issue?

2

Hi @lachlancooper,

You're right, there seems to be an issue here. I can confirm the behavior is different when keepfiles: 7 is specified, so that cannot be the default.

Please file an issue

3

Thanks, I've filed this issue: https://github.com/elastic/beats/issues/7494

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.