About this ERR log:
2016-09-07T20:25:40+08:00 ERR File is falling under ignore_older before harvesting is finished. Adjust your close_* settings
I got your explain at Filebeat Stop Cleaning Registry - #8 by Gabry993 :
The first error is shown, in case a file did not finish harvesting yet but already falls under ignore_older. This can for example happen when a file is not updated anymore, but the harvester can't finish reading it as the output is not available or too slow. As soon as the output catches up, the file will be closed and ignored.
But in my case, the ERR log is appeared when start filebeat, the file should not begin harvesting, not "in case a file did not finish harvesting yet " .