I came with this scenario just recently.
Before i install xpack, logstash can log rotate my logs in /var/log/logstash directory. Upon checking just recently, i noticed that my last log file was logstash-plain-2018-02-18.log and logs from then was written in logstash-plain.log. Btw, we do have CRON job to retain only past 3 days of logs.
Here's our logstash.yml
config.reload.automatic: true path.config: /etc/logstash/conf.d/*.conf path.data: /var/lib/logstash path.logs: /var/log/logstash pipeline.output.workers: 3 pipeline.workers: 6 queue.max_events: 1000 queue.type: persisted queue.max_bytes: 8gb
Can someone tell my whats the possible reason behind this?