delete ES/LS logs after 7 days

Security-Onion-Solutions · Mar 1, 2018 · 0d58321 · 0d58321
1 parent 078243a
commit 0d58321
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 4 deletions.
diff --git a/etc/elasticsearch/log4j2.properties b/etc/elasticsearch/log4j2.properties
@@ -5,7 +5,8 @@ status = error
 #appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n
 #rootLogger.level = info
 #rootLogger.appenderRef.console.ref = console
-# This is a test -- if this here, then the volume is mounted correctly.
+
+# Define logging settings
 appender.rolling.type = RollingFile
 appender.rolling.name = rolling
 appender.rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}.log
@@ -16,5 +17,12 @@ appender.rolling.policies.type = Policies
 appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
 appender.rolling.policies.time.interval = 1
 appender.rolling.policies.time.modulate = true
+appender.rolling.strategy.type = DefaultRolloverStrategy
+appender.rolling.strategy.action.type = Delete
+appender.rolling.strategy.action.basepath = ${sys:es.logs.base_path}
+appender.rolling.strategy.action.condition.type = IfFileName
+appender.rolling.strategy.action.condition.glob = ${sys:es.logs.cluster_name}-*.log
+appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
+appender.rolling.strategy.action.condition.nested_condition.age = 7D
 rootLogger.level = info
 rootLogger.appenderRef.rolling.ref = rolling
diff --git a/etc/logstash/log4j2.properties b/etc/logstash/log4j2.properties
@@ -12,7 +12,7 @@ name = LogstashPropertiesConfig
 #appender.json_console.layout.compact = true
 #appender.json_console.layout.eventEol = true
 
-#This is is a test -- if this here, then the volume is mounted correctly.
+#Define logging settings.
 appender.rolling.type = RollingFile
 appender.rolling.name = rolling
 appender.rolling.fileName = /var/log/logstash/logstash.log
@@ -23,7 +23,14 @@ appender.rolling.policies.type = Policies
 appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
 appender.rolling.policies.time.interval = 1
 appender.rolling.policies.time.modulate = true
-#rootLogger.level = info
+appender.rolling.strategy.type = DefaultRolloverStrategy
+appender.rolling.strategy.action.type = Delete
+appender.rolling.strategy.action.basepath = /var/log/logstash
+appender.rolling.strategy.action.condition.type = IfFileName
+appender.rolling.strategy.action.condition.glob = logstash-*.log
+appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
+appender.rolling.strategy.action.condition.nested_condition.age = 7D
+rootLogger.level = info
 rootLogger.appenderRef.rolling.ref = rolling
-rootLogger.level = ${sys:ls.log.level}
+#rootLogger.level = ${sys:ls.log.level}
 #rootLogger.appenderRef.console.ref = ${sys:ls.log.format}_console