Jan 24, 2017 · Log Rotation. Log rotation can be configured using the –vacuum-size and –vacuum-time option. The first sets a limit on the available disk space for saving logs (in our example, it’s 1 GB): $ sudo journalctl --vacuum-size=1G As soon as the log size exceeds this limit, unnecessary files will be automatically deleted.
Please adjust the log rotation so that the kibana.log file is also rotated! In our environment it is not necessary at the moment. But important on a production system. Prior to 0.10.3-4 the default config logged to file and this aur package provided a log rotate. that log rotate is no longer included BUT your config is part of backup if you already installed so you may either want to manually manage the log rotate going forward OR change to log to journald (suggested) * To rotate logs when they reach a small size, say 50MB * To keep something like 5GB or more of logs, to be able to record stuff happened for months * To make sure journalctl, by default, reads only the latest of the 50MB files, to keep reading times short
Journald supports the concept of adding structured metadata in addition to the log message in question. This makes it much easier to take the output of journald and push it into other logging systems like Elastic Search, without needing to regex guess relevant data. It also allows you to search the journal by these fields using journalctl.