Hello everyone.
I came with this scenario just recently.
Before i install xpack, logstash can log rotate my logs in /var/log/logstash directory. Upon checking just recently, i noticed that my last log file was logstash-plain-2018-02-18.log and logs from then was written in logstash-plain.log. Btw, we do have CRON job to retain only past 3 days of logs.
Here's our logstash.yml
config.reload.automatic: true
path.config: /etc/logstash/conf.d/*.conf
path.data: /var/lib/logstash
path.logs: /var/log/logstash
pipeline.output.workers: 3
pipeline.workers: 6
queue.max_events: 1000
queue.type: persisted
queue.max_bytes: 8gb
Can someone tell my whats the possible reason behind this?