This message was deleted.

We solve this by using Filebeat on all our RKE2 clusters. Filebeat runs on all cluster as a demonset, then pipes all logs from the nodes to ELK for processing. This allows us to choose our own log retention. I'm sure you could do a similar method for your cluster running Rancher.