[Logging] Add reverse numeric rolling strategy

[afharo]

Currently, Kibana's numeric log rolling strategy is applied so the most-recently-rotated file has the lowest number (kibana-1.log) and the oldest file has the largest number (kibana-10.log).

This means that on every log rotation, all rotated files are renamed (assuming max: 10):

1. kibana-10.log is deleted
2. kibana-9.log is renamed to kibana-10.log
3. kibana-8.log -> kibana-9.log
4. ...
5. kibana-1.log -> kibana-2.log
6. kibana.log -> kibana-1.log

This matches how log4j's DefaultRolloverStrategy works if specified the option fileIndex="min".

However, some folks prefer their log rotation to happen in a way that the highest number is the most recent (default DefaultRolloverStrategy):

1. kibana.log -> kibana-1.log
2. kibana.log -> kibana-2.log (leaving kibana-1.log untouched)

We may also consider adding the nomax behaviour for feature parity.

Refer to https://logging.apache.org/log4j/2.x/manual/appenders.html > Rollover Strategies for better examples of how the Rollover Strategies work in log4j.

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[pgayvallet]

However, some folks prefer their log rotation to happen in a way that the highest number is the oldest

Yea, that's how the current rolling strategy works. You meant the other way around, I assume?

My main question is, how do you manage the maxFile option when in such reverse order.

E.g:

• you have maxFile=3
• You have kibana.log, kibana-1.log, kibana-2.log, kibana-3.log
• A rollover is triggered.

What are we doing?

1. delete kibana-1.log and move kibana.log to kibana-4.log file?
2. delete kibana-1.log and reverse rename the files (2->1, 3->2), then move kibana.log to kibana-3.log?
3. something else?

Refer to https://logging.apache.org/log4j/2.x/manual/appenders.html > Rollover Strategies for better examples of how the Rollover Strategies work in log4j

EDIT:

In the fourth and subsequent rollovers, foo-1.log is deleted, foo-2.log is renamed to foo-1.log, foo-3.log is renamed to foo-2.log and foo.log is renamed to foo-3.log. A new foo.log file is created and starts being written to.

I guess I just had to RTFM :)

[afharo]

Yea, that's how the current rolling strategy works. You meant the other way around, I assume?

yes! I need a coffee! I meant "most recent". Edited the description! Thanks for highlighting it! 🧡