# Too many log files?

**URL:** https://discuss.elastic.co/t/too-many-log-files/20934
**Category:** Elasticsearch
**Created:** [November 25, 2014, 11:43am UTC](https://discuss.elastic.co/t/too-many-log-files/20934 "2014-11-25T11:43:12Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Siddharth\_Trikha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siddharth_trikha/32/133867_2.png) [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)
#### Post date: [November 25, 2014, 11:43am UTC](https://discuss.elastic.co/t/too-many-log-files/20934/1 "2014-11-25T11:43:12Z")

</div>

Setup:

Rsyslog provides log from mutiple servers to a central server. Directory  
structure is like:

```
/var/log/rsyslog/SERVER-1/2014-10-21/*.log

/var/log/rsyslog/SERVER-2/2014-10-21/*.log

```

So multiple server directories each having multiple dates within and  
multiple log files.

Now, we setup ELK to read store and view these logs.

Eg: Logstash

```
 file{
            path => [
             "/var/log/rsyslog/**/cron.log",
             "/var/log/rsyslog/**/kernel.log",
            ]
 
     }

```

Issue:

Every day a new directory with current date say 2014-11-25 is created and  
logstash tracks it with the glob input.

So logstash will keep on opening files as they are added and after a point  
nofile limit will cross.

What is the best way to handle this?

I read online about log rotation but that I guess is when file size grows  
lot, but my issue is of number of files.

Any help is appreciated.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/5c7030a9-2e9c-40fa-a4bb-8fa2ae38089e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/5c7030a9-2e9c-40fa-a4bb-8fa2ae38089e%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:47am UTC](https://discuss.elastic.co/t/too-many-log-files/20934/2 "2017-07-06T00:47:47Z")

</div>