I am using the default log4j2 supplied with Logstash 6.3.2 installed from the Debian repo.
status = error
name = LogstashPropertiesConfig
appender.console.type = Console
appender.console.name = plain_console
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %m%n
appender.json_console.type = Console
appender.json_console.name = json_console
appender.json_console.layout.type = JSONLayout
appender.json_console.layout.compact = true
appender.json_console.layout.eventEol = true
appender.rolling.type = RollingFile
appender.rolling.name = plain_rolling
appender.rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log
appender.rolling.filePattern = ${sys:ls.logs}/logstash-${sys:ls.log.format}-%d{yyyy-MM-dd}-%i.log.gz
appender.rolling.policies.type = Policies
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.rolling.policies.time.interval = 1
appender.rolling.policies.time.modulate = true
appender.rolling.layout.type = PatternLayout
appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %-.10000m%n
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.rolling.policies.size.size = 100MB
appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.fileIndex = nomax
appender.rolling.strategy.action.type = Delete
appender.rolling.strategy.action.basepath = ${sys:ls.logs}
appender.rolling.strategy.action.condition.type = IfFileName
appender.rolling.strategy.action.condition.glob = logstash-${sys:ls.log.format}-*
appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
appender.rolling.strategy.action.condition.nested_condition.age = 7D
The appender.rolling.strategy.action.condition.nested_condition.age = 7D is not working. I currently have logs dating back to June.
myuser@logstash1:/var/log/logstash$ ls -lah
total 28M
drwxrwxr-x 2 logstash root 4.0K Aug 16 11:59 .
drwxrwxr-x 16 root root 4.0K Aug 17 06:25 ..
-rw-r--r-- 1 logstash logstash 876K Jun 25 15:12 logstash-plain-2018-06-25-1.log.gz
-rw-r--r-- 1 logstash logstash 875K Jun 25 15:20 logstash-plain-2018-06-25-2.log.gz
-rw-r--r-- 1 logstash logstash 861K Jun 25 15:28 logstash-plain-2018-06-25-3.log.gz
-rw-r--r-- 1 logstash logstash 893K Jun 25 15:36 logstash-plain-2018-06-25-4.log.gz
-rw-r--r-- 1 logstash logstash 921K Jun 25 15:48 logstash-plain-2018-06-25-5.log.gz
-rw-r--r-- 1 logstash logstash 1.1M Jun 25 16:06 logstash-plain-2018-06-25-6.log.gz
-rw-r--r-- 1 logstash logstash 996K Jun 25 16:34 logstash-plain-2018-06-25-7.log.gz
-rw-r--r-- 1 logstash logstash 1.1M Jun 25 17:05 logstash-plain-2018-06-25-8.log.gz
-rw-r--r-- 1 logstash logstash 196K Jun 26 15:40 logstash-plain-2018-06-25-9.log.gz
-rw-r--r-- 1 logstash logstash 1.2M Jun 26 21:49 logstash-plain-2018-06-26-1.log.gz
-rw-r--r-- 1 logstash logstash 433K Jun 27 00:02 logstash-plain-2018-06-26-2.log.gz
-rw-r--r-- 1 logstash logstash 1.1M Jun 28 00:05 logstash-plain-2018-06-27-1.log.gz
-rw-r--r-- 1 logstash logstash 143K Jun 29 14:27 logstash-plain-2018-06-28-1.log.gz
-rw-r--r-- 1 logstash logstash 1.9K Jul 3 11:02 logstash-plain-2018-06-29-1.log.gz
-rw-r--r-- 1 logstash logstash 1.7K Jul 5 18:39 logstash-plain-2018-07-03-1.log.gz
-rw-r--r-- 1 logstash logstash 47K Jul 6 00:00 logstash-plain-2018-07-05-1.log.gz
-rw-r--r-- 1 logstash logstash 23K Jul 13 03:26 logstash-plain-2018-07-06-1.log.gz
-rw-r--r-- 1 logstash logstash 27K Jul 14 00:17 logstash-plain-2018-07-13-1.log.gz
-rw-r--r-- 1 logstash logstash 335K Jul 15 00:00 logstash-plain-2018-07-14-1.log.gz
-rw-r--r-- 1 logstash logstash 536K Jul 16 00:00 logstash-plain-2018-07-15-1.log.gz
-rw-r--r-- 1 logstash logstash 274K Jul 18 04:24 logstash-plain-2018-07-16-1.log.gz
-rw-r--r-- 1 logstash logstash 91K Jul 19 00:00 logstash-plain-2018-07-18-1.log.gz
-rw-r--r-- 1 logstash logstash 427K Jul 20 02:08 logstash-plain-2018-07-19-1.log.gz
-rw-r--r-- 1 logstash logstash 2.0K Jul 23 03:52 logstash-plain-2018-07-20-1.log.gz
-rw-r--r-- 1 logstash logstash 27K Jul 28 03:14 logstash-plain-2018-07-23-1.log.gz
-rw-r--r-- 1 logstash logstash 207 Jul 29 03:23 logstash-plain-2018-07-28-1.log.gz
-rw-r--r-- 1 logstash logstash 74K Jul 30 00:00 logstash-plain-2018-07-29-1.log.gz
-rw-r--r-- 1 logstash logstash 411K Jul 31 06:50 logstash-plain-2018-07-30-1.log.gz
-rw-r--r-- 1 logstash logstash 187 Aug 1 02:40 logstash-plain-2018-07-31-1.log.gz
-rw-r--r-- 1 logstash logstash 34K Aug 3 12:10 logstash-plain-2018-08-01-1.log.gz
-rw-r--r-- 1 logstash logstash 173K Aug 8 16:01 logstash-plain-2018-08-03-1.log.gz
-rw-r--r-- 1 logstash logstash 700 Aug 9 02:44 logstash-plain-2018-08-08-1.log.gz
-rw-r--r-- 1 logstash logstash 806 Aug 10 02:03 logstash-plain-2018-08-09-1.log.gz
-rw-r--r-- 1 logstash logstash 972 Aug 11 10:42 logstash-plain-2018-08-10-1.log.gz
-rw-r--r-- 1 logstash logstash 756 Aug 13 20:15 logstash-plain-2018-08-11-1.log.gz
-rw-r--r-- 1 logstash logstash 702 Aug 14 02:32 logstash-plain-2018-08-13-1.log.gz
-rw-r--r-- 1 logstash logstash 935 Aug 15 02:12 logstash-plain-2018-08-14-1.log.gz
-rw-r--r-- 1 logstash logstash 132K Aug 16 11:59 logstash-plain-2018-08-15-1.log.gz
-rw-r--r-- 1 logstash logstash 15M Aug 16 15:42 logstash-plain.log
-rw-r--r-- 1 logstash logstash 0 Jun 25 07:03 logstash-slowlog-plain.log
Is there anything else I need to do to get this working? This behaviour is identical on both of our Logstash hosts.