diff --git a/filebeat/docs/running-on-kubernetes.asciidoc b/filebeat/docs/running-on-kubernetes.asciidoc index d7d92650032..cf4c9ba6886 100644 --- a/filebeat/docs/running-on-kubernetes.asciidoc +++ b/filebeat/docs/running-on-kubernetes.asciidoc @@ -218,3 +218,12 @@ annotations: co.elastic.logs.json-logging/json.add_error_key: "true" co.elastic.logs.json-logging/json.message_key: "message" ------------------------------------------------ + +[float] +==== Logrotation + +According to https://kubernetes.io/docs/concepts/cluster-administration/logging/#logging-at-the-node-level[kubernetes documentation] +_Kubernetes is not responsible for rotating logs, but rather a deployment tool should set up a solution to address that_. +Different logrotation strategies can cause issues that might make Filebeat losing events or even duplicating events. +Users can find more information about Filebeat's logrotation best practises at Filebeat's +<>