# Understand log4j default strategy
**URL:** https://discuss.elastic.co/t/understand-log4j-default-strategy/261622
**Category:** Elasticsearch
**Created:** [January 20, 2021, 9:04am UTC](https://discuss.elastic.co/t/understand-log4j-default-strategy/261622 "2021-01-20T09:04:30Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Travis](https://discuss.elastic.co/u/Travis)
#### Post date: [January 20, 2021, 9:04am UTC](https://discuss.elastic.co/t/understand-log4j-default-strategy/261622/1 "2021-01-20T09:04:30Z")
Hello all !
I'm not sure about my understanding of the default Elasticsearch log4j strategy :
```
######## Server JSON ############################
appender.rolling.type = RollingFile
appender.rolling.name = rolling
appender.rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_server.json
appender.rolling.layout.type = ESJsonLayout
appender.rolling.layout.type_name = server
appender.rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}-%d{yyyy-MM-dd}-%i.json.gz
appender.rolling.policies.type = Policies
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.rolling.policies.time.interval = 1
appender.rolling.policies.time.modulate = true
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.rolling.policies.size.size = 128MB
appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.fileIndex = nomax
appender.rolling.strategy.action.type = Delete
appender.rolling.strategy.action.basepath = ${sys:es.logs.base_path}
appender.rolling.strategy.action.condition.type = IfFileName
appender.rolling.strategy.action.condition.glob = ${sys:es.logs.cluster_name}-*
appender.rolling.strategy.action.condition.nested_condition.type = IfAccumulatedFileSize
appender.rolling.strategy.action.condition.nested_condition.exceeds = 2GB
```
What I understand :
- Log will rollover if log reached a **max age of 1d** or a **max size of 128MB**. Right ?
- There is no limit to create logs files ( **fileIndex = nomax** ). Right ?
- Log will be deleted if **accumulated file size** of log has reached **2GB**. Right ? If this is the case, which logs will be deleted ? all ?
Also, If I want to keep only 7 days of logs, I have to replace this (the two last lines) :
> appender.rolling.strategy.action.condition.nested\_condition.type = IfAccumulatedFileSize
> appender.rolling.strategy.action.condition.nested\_condition.exceeds = 2GB
By this :
> appender.rolling.strategy.action.condition.nested\_condition.type = IfLastModified
> appender.rolling.strategy.action.condition.nested\_condition.age = 7D
And keep all what is above
Right ?
Thanks for your help !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 17, 2021, 9:04am UTC](https://discuss.elastic.co/t/understand-log4j-default-strategy/261622/2 "2021-02-17T09:04:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.