ERR Failed opening: too many open files

Elastic Stack Beats
1

Hi,

I am using logstash 2.3.0 and Filebeat 1.2.0. I have upgraded logstash-input-beats to 2.2.7.

I ran filebeat using the below command
/bin/filebeat -c /config/filebeat.yml -e -v "*". I am getting below error.

2016/04/07 19:12:56.919663 log.go:248: ERR Failed opening /logs/3ea66588f58a.xml: open /logs/3ea66588f58a.xml: too many open files
2016/04/07 19:12:56.919686 log.go:103: ERR Stop Harvesting. Unexpected file opening error: open /logs/3ea66588f58a.xml: too many open files.

Is there any bug in this version?

Thanks in advance

2

Limit of open files is determined by OS. Check ulimit. Filebeat keeps files open for quite some time (search for close_older option). Files are finally closed after close_older (default 1h). If new files get generated and written to very fast, reduce close_older maybe to a few minutes. close_older should be big enough to not close file between consecutive writes by accident, which is not too bad though as prospector will reopen file in that case.