Adding logrotation in elasticsearch

Elasticsearch supports log rotation with built in functionality you just need to configure the log4j.properties for the same.

Just copy the below configuration file at the following location

vim /etc/elasticsearch/log4j2.properties

 +status = error  

 +
 +# log action execution errors for easier debugging
 +logger.action.name = org.elasticsearch.action
 +logger.action.level = debug
 +
 +appender.console.type = Console
 +appender.console.name = console
 +appender.console.layout.type = PatternLayout
 +appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n
 +
 +appender.rolling.type = RollingFile
 +appender.rolling.name = rolling
 +appender.rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}.log
 +appender.rolling.layout.type = PatternLayout
 +appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%.-10000m%n
 +appender.rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}-%d{yyyy-MM-dd}.log.gz
 +appender.rolling.policies.type = Policies
 +appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
 +appender.rolling.policies.time.interval = 1
 +appender.rolling.policies.time.modulate = true
 +
 +appender.rolling.strategy.type = DefaultRolloverStrategy
 +appender.rolling.strategy.action.type = Delete
 +appender.rolling.strategy.action.basepath = ${sys:es.logs.base_path}
 +appender.rolling.strategy.action.condition.type = IfLastModified
 +appender.rolling.strategy.action.condition.age = 5D
 +appender.rolling.strategy.action.PathConditions.type = IfFileName
 +appender.rolling.strategy.action.PathConditions.glob = ${sys:es.logs.cluster_name}-*
 +
 +rootLogger.level = info
 +rootLogger.appenderRef.console.ref = console
 +rootLogger.appenderRef.rolling.ref = rolling
 +
 +appender.deprecation_rolling.type = RollingFile
 +appender.deprecation_rolling.name = deprecation_rolling
 +appender.deprecation_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation.log
 +appender.deprecation_rolling.layout.type = PatternLayout
 +appender.deprecation_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%.-10000m%n
 +appender.deprecation_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation-%i.log.gz
 +appender.deprecation_rolling.policies.type = Policies
 +appender.deprecation_rolling.policies.size.type = SizeBasedTriggeringPolicy
 +appender.deprecation_rolling.policies.size.size = 1GB
 +appender.deprecation_rolling.strategy.type = DefaultRolloverStrategy
 +appender.deprecation_rolling.strategy.max = 4
 +
 +logger.deprecation.name = org.elasticsearch.deprecation
 +logger.deprecation.level = warn
 +logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_rolling
 +logger.deprecation.additivity = false
 +
 +appender.index_search_slowlog_rolling.type = RollingFile
 +appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling
 +appender.index_search_slowlog_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_search_slowlog.log
 +appender.index_search_slowlog_rolling.layout.type = PatternLayout
 +appender.index_search_slowlog_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %marker%.-10000m%n
 +appender.index_search_slowlog_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_search_slowlog-%d{yyyy-MM-dd}.log
 +appender.index_search_slowlog_rolling.policies.type = Policies
 +appender.index_search_slowlog_rolling.policies.time.type = TimeBasedTriggeringPolicy
 +appender.index_search_slowlog_rolling.policies.time.interval = 1
 +appender.index_search_slowlog_rolling.policies.time.modulate = true
 +
 +logger.index_search_slowlog_rolling.name = index.search.slowlog
 +logger.index_search_slowlog_rolling.level = trace
 +logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref = index_search_slowlog_rolling
 +logger.index_search_slowlog_rolling.additivity = false
 +
 +appender.index_indexing_slowlog_rolling.type = RollingFile
 +appender.index_indexing_slowlog_rolling.name = index_indexing_slowlog_rolling
 +appender.index_indexing_slowlog_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_indexing_slowlog.log
 +appender.index_indexing_slowlog_rolling.layout.type = PatternLayout
 +appender.index_indexing_slowlog_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %marker%.-10000m%n
 +appender.index_indexing_slowlog_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_indexing_slowlog-%d{yyyy-MM-dd}.log
 +appender.index_indexing_slowlog_rolling.policies.type = Policies
 +appender.index_indexing_slowlog_rolling.policies.time.type = TimeBasedTriggeringPolicy
 +appender.index_indexing_slowlog_rolling.policies.time.interval = 1
 +appender.index_indexing_slowlog_rolling.policies.time.modulate = true
 +
 +logger.index_indexing_slowlog.name = index.indexing.slowlog.index
 +logger.index_indexing_slowlog.level = trace
 +logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref = index_indexing_slowlog_rolling
 +logger.index_indexing_slowlog.additivity = false