Unable to remove the unwanted messages(especially Auditbeat) in my centos server

Question

I need your help in solving the below mentioned Issue.

I have Installed Auditbeat-7.3.1 as a part of ELK setup in my centos server. Everything was working well, But i was facing problem while deleting the Auditebat Messages which are located under the "/var/log/messages" folder path. These Messages are consuming a lot of space. Its becoming a problem for me to Manually remove the message contents everytime.

Also, I have written a small script which reads these message contents in the specified directory and removes it. But when i Executed the script It was just moving the messages from that file and placing them in another location.

I'm not able to find a solution for this problem.

TIA, For you help.

Answer 1

Instead of manually trying to clean unwanted log entries after they appear, why don't you simply adjust the logging in auditbeat?

The default is info, try setting the log level to error:

logging.level: error

There are several other options, such as logging to a different location as referenced here.

I would personally try to exhaust all of them to find a solution rather than writing custom scripts to remove stuff that shouldn't be there to begin with.

Finally, although I don't object to this question being here on U&L, the Elastic stack has a pretty vibrant community: https://discuss.elastic.co/

Perhaps your question is better suited there?