How to limit *-json.log in elk filebeat

Question

I have filebeat in docker with next filebeat.yml

output.elasticsearch:
  hosts: ["http://elastic:9200"]
  index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"

setup.template.name: "filebeat-%{[agent.version]}"
setup.template.pattern: "filebeat-%{[agent.version]}-*"

filebeat.inputs:
   - type: docker
     containers.ids:
       - '*'
     processors:
       - add_docker_metadata: ~

# Write Filebeat own logs only to file to avoid catching them with itself in docker log files
logging.level: error
logging.to_files: false
logging.to_syslog: false
loggins.metrice.enabled: false
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 2
  permissions: 0644
ssl.verification_mode: none

inside container there are *-json.log file which grows without limit and rotation

~$ sudo ls -l -h /var/lib/docker/containers/c46dfab2c3399131faf4c2d6eda14aabb780e9e3cfb9e798f9740691c26588b5
total 7.2G
-rw-r----- 1 root root 7.2G Feb 25 09:27 c46dfab2c3399131faf4c2d6eda14aabb780e9e3cfb9e798f9740691c26588b5-json.log

Are there any way to disable/limit/rotate log in this file ?

Answer 1

Since you are using Swarm, you can configure your services to rotate the log files based on their size. check the example provided below

version: '3.7'

volumes:
  db_data:

services:

  mysql:
    image: mysql:5.7
    command: mysqld
    deploy:
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 3
        window: 120s
      update_config:
        delay: 10s
        order: start-first
        parallelism: 1
      rollback_config:
        parallelism: 0
        order: stop-first
    logging:
      driver: json-file
      options:
        'max-size': '10m'
        'max-file': '5'
    volumes:
      - db_data:/var/lib/mysql
    environment:
      MYSQL_ROOT_PASSWORD: dummy
      MYSQL_DATABASE: rails_production