From bed1b2ebb3cdc3db5673440e4784cb3b89894cb2 Mon Sep 17 00:00:00 2001 From: Chris Mark Date: Fri, 19 Feb 2021 13:56:36 +0200 Subject: [PATCH] Add logrotation section on Running Filebeat on k8s (#24120) (cherry picked from commit ea5d413d6e2a620e65311f4cfc0fec678e62d6f4) --- filebeat/docs/running-on-kubernetes.asciidoc | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/filebeat/docs/running-on-kubernetes.asciidoc b/filebeat/docs/running-on-kubernetes.asciidoc index d7d92650032..cf4c9ba6886 100644 --- a/filebeat/docs/running-on-kubernetes.asciidoc +++ b/filebeat/docs/running-on-kubernetes.asciidoc @@ -218,3 +218,12 @@ annotations: co.elastic.logs.json-logging/json.add_error_key: "true" co.elastic.logs.json-logging/json.message_key: "message" ------------------------------------------------ + +[float] +==== Logrotation + +According to https://kubernetes.io/docs/concepts/cluster-administration/logging/#logging-at-the-node-level[kubernetes documentation] +_Kubernetes is not responsible for rotating logs, but rather a deployment tool should set up a solution to address that_. +Different logrotation strategies can cause issues that might make Filebeat losing events or even duplicating events. +Users can find more information about Filebeat's logrotation best practises at Filebeat's +<>