Beats log files should be generated with timestamped filenames

[cruscio]

FileBeat's own logging mechanism doesn't support the file logging convention recommended in its documentation. Beat logging should have an option to generate log files with timestamped names when keepfiles is greater than zero.

More about log rotation on Windows

On Windows, log rotation schemes that delete old files and rename newer files to old filenames might get blocked if the old files are being processed by Filebeat. This happens because Windows does not delete files and file metadata until the last process has closed the file. Unlike most *nix filesystems, a Windows filename cannot be reused until all processes accessing the file have closed the deleted file.

To avoid this problem, use dates in rotated filenames. The file will never be renamed to an older filename, and the log writer and log rotator will always be able to open the file. This approach also highly reduces the chance of log writing, rotation, and collection interfering with each other.

Ref:
https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html
https://www.elastic.co/guide/en/beats/filebeat/current/file-log-rotation.html#log-rotation-windows

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[seadub]

+1. Would prefer to have a daily rotation for maintenance purposes. filebeat.${yyyy-mm-dd}.log would be ideal.

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[cruscio]

Still relevant - Doesn't look like it's changed in the latest release (8.2 currently)
https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-logging.html

[kvch]

The documentation seems out of date. In the breaking changes log, you can see that we modified the name of the logs every Beat writes to:

Remove logging.files.suffix option, and default to datetime endings in log file names. The format of the new name is {beatname}-{date}(-n)?.ndjson. Example log file names from oldest to newest: filebeat-20200101.ndjson, filebeat-20200101-1.ndjson, filebeat-20200101-2.ndjson. 28927

Ref: https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-8.0.0.html#_breaking_changes_3

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[cruscio]

👍

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[cruscio]

👍 😑