# Incorrect default for Filebeat logging.files.keepfiles

**URL:** <https://discuss.elastic.co/t/incorrect-default-for-filebeat-logging-files-keepfiles/138293>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 3, 2018, 1:17am UTC](https://discuss.elastic.co/t/incorrect-default-for-filebeat-logging-files-keepfiles/138293 "2018-07-03T01:17:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lachlancooper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lachlancooper/32/32889_2.png) [@lachlancooper](https://discuss.elastic.co/u/lachlancooper)\
**Post date:** [July 3, 2018, 1:17am UTC](https://discuss.elastic.co/t/incorrect-default-for-filebeat-logging-files-keepfiles/138293/1 "2018-07-03T01:17:33Z")

</div>

The [documented default value](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html) for Filebeat's `logging.files.keepfiles` is 7, but in my testing this doesn't seem to be accurate. The actual default seems to be 0, meaning Filebeat doesn't keep any rotated log files.

How to reproduce:

1. Install filebeat (I'm running 6.3.0 on Ubuntu 14.04 from the Elastic Apt repository).
2. Confirm that `/etc/filebeat/filebeat.yml` does not define any value for `logging.files.keepfiles`.
3. Start the service: `service filebeat start`.
4. Confirm that a log file is created at `/var/log/filebeat/filebeat`.
5. Restart the service: `service filebeat restart`, triggering a log rotate.
6. Confirm that the previous log file was overwritten when it should have been rotated: only one file exists under `/var/log/filebeat`.
7. Explicitly set `logging.files.keepfiles: 7` in `/etc/filebeat/filebeat.yml`.
8. Restart the service: `service filebeat restart`, triggering another log rotate.
9. Confirm that the previous log file was rotated correctly, and now exists at `/var/log/filebeat/filebeat.1`.

I've searched but can't find any previous reports of this bug. Should I file an issue?

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 3, 2018, 8:25am UTC](https://discuss.elastic.co/t/incorrect-default-for-filebeat-logging-files-keepfiles/138293/2 "2018-07-03T08:25:04Z")

</div>

Hi @lachlancooper,

You're right, there seems to be an issue here. I can confirm the behavior is different when `keepfiles: 7` is specified, so that cannot be the default.

Please [file an issue](https://github.com/elastic/beats/issues/new)

---

<div class="post-metadata">

**Author:** ![lachlancooper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lachlancooper/32/32889_2.png) [@lachlancooper](https://discuss.elastic.co/u/lachlancooper)\
**Post date:** [July 3, 2018, 12:15pm UTC](https://discuss.elastic.co/t/incorrect-default-for-filebeat-logging-files-keepfiles/138293/3 "2018-07-03T12:15:23Z")

</div>

Thanks, I've filed this issue: [https://github.com/elastic/beats/issues/7494](https://github.com/elastic/beats/issues/7494)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 31, 2018, 2:15pm UTC](https://discuss.elastic.co/t/incorrect-default-for-filebeat-logging-files-keepfiles/138293/4 "2018-07-31T14:15:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.