I am just curious about the logging for Elasticsearch, (running 7.17.3) as they appear much larger then what I typically expect for application logging. I have run into issues where the logs have filled my logging partition as they are allows to grow so large.
I get that it duplicates the logs to have them in both JSON and human readable. But why retain 2GB of compressed logs (in each case) that seems a little excessive. There are a number of other logs (deprecation, slowlog* (I understand these are effectively off until you set the thresholds)) that combined can take up to 30GB of space at capacity according to the log4j 2 config for Elasticsearch. And then there are the gc.logs (set with the jvm.options file) that can retain another 2 GB.
It looks like default settings could potential retain 36 GB of logs. I am wondering why this is the case and if it is necessary?