logrotate should be optional

[voelzmo]

Opening this issue after discussion in https://discuss.elastic.co/t/how-to-disable-logrotate/62714

Following the documentation at https://www.elastic.co/guide/en/beats/packetbeat/master/configuration-logging.html1 I was looking for a way to disable logrotate. Is that even possible at all? How well would packetbeat deal with an external logrotate mechanism?

My reason is: The logfiles within my distributed system sit by convention in a specific directory. There is already logrotate.d configured for that directory, I don't want another entity manage the logs specifically for packetbeat.

[tsg]

Is that even possible at all?

Not really. You could simulate it by setting a huge value for rotateeverybytes.

How well would packetbeat deal with an external logrotate mechanism?

Probably not well, because it doesn't reopen the file periodically.

We'd need a feature that instead of doing file rotation it would reopen the same filename again every N seconds.

[voelzmo]

Hey, just checking back on this – any further progress on prioritizing this?

[ruflin]

@voelzmo Not yet. I think we start to tackle this as soon as we start refactoring logging in general. Can't provide any timeline here, sorry :-(

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[C-Duv]

Still an issue.

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[jlind23]

Backlog grooming: Closing it for now until further activity, can still be reopened if needed.