Linux add custom logrotate configuration

On Linux logrotate is a package that is used to automatically rotate logfiles on a set interval. This can be done on a daily basis, or when the log file exceeds a certain filesize.

Rotating logs means that a logfile is automatically truncated preventing it from growing indefinitely.

Example logrotate conf file for Kibana

Logrotate configuration files are usually stored in the folder /etc/logrotate.d. Simply create a new file in this folder with the configuration for the logfile you wish to rotate.

1. Create logrotate conf file:

sudo nano /etc/logrotate.d/kibana

2. Add the following contents to this file:

/var/log/kibana/kibana.log {
    daily
    rotate 7
    copytruncate
    compress
    missingok
    notifempty
}

The above config will automatically logrotate the “/var/log/kibana/kibana.log” logfile daily, and will preserve the last 7 days of logfiles in a compressed state. This makes sure that the logfile cannot grow bigger than 7 days of data, and all logdata except the current day will be compressed to save on diskspace.

Note: since logrotate runs via cron, it is not necessary to restart a service. After creating or changing a logrotate config file, the changes will automatically be picked up on the next logrotate run.