Too many log files?


Rsyslog provides log from mutiple servers to a central server. Directory
structure is like:



So multiple server directories each having multiple dates within and
multiple log files.

Now, we setup ELK to read store and view these logs.

Eg: Logstash

            path => [


Every day a new directory with current date say 2014-11-25 is created and
logstash tracks it with the glob input.

So logstash will keep on opening files as they are added and after a point
nofile limit will cross.

What is the best way to handle this?

I read online about log rotation but that I guess is when file size grows
lot, but my issue is of number of files.

Any help is appreciated.

You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
To view this discussion on the web visit
For more options, visit