Kubernetes & Docker max-size

Elastic Stack Beats
3

Cool beans.

So in the Docker daemon configuration, you set the logging driver to JSON (the default anyway) and can set max-size and max-files options:

 {
   "log-driver": "json-file",
   "log-opts": {
     "max-size": "10m",
     "max-file": "5"
   }
 }

The only draw back, is looking at the Kubernetes logging documentation (Logging Architecture | Kubernetes), if you have more than one log file, it seems like kubectl logs will output the latest:

Note: Currently, if some external system has performed the rotation, only the contents of the latest log file will be available through kubectl logs. E.g. if there’s a 10MB file, logrotate performs the rotation and there are two files, one 10MB in size and one empty, kubectl logs will return an empty response.

Which really shouldn't be a problem if Filebeat is working correctly as we should be getting all output into Elastic and view-able in Kibana.