I am facing an issue with log retention in my Elastic Stack setup and could use some help in troubleshooting it. Currently, my system is only retaining logs for 10 days, and after that, the logs are being deleted. I have checked several factors, including logrotate, crontab, and any external scripts that might be causing this behavior, but everything seems fine.
Here are some details about my environment:
- Elastic Version: 8.6.2
- Kibana Version: 8.6.2
- Logstash Version: 8.6.2
- Operating System: CentOS 8
My Logstash container configuration (docker-compose.yml):
... logstash: container_name: ip_logstash image: logstash:8.6.2 ports: - '514:514/udp' environment: - xpack.monitoring.enabled= true volumes: - type: bind source: ./logstash/pipeline target: /usr/share/logstash/pipeline read_only: true - type: bind source: /tmp/devices_output_logs target: /var/log/syslog read_only: false ...
Any suggestions or insights into what might be causing the log retention issue would be highly appreciated. Has anyone encountered a similar problem or have any specific troubleshooting steps I can try?
Thank you in advance for your help!