# ERR File is falling under ignore\_older before harvesting is finished. Adjust your close\_\* settings: api\_1.log **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 9, 2016, 1:26pm UTC](https://discuss.elastic.co/t/err-file-is-falling-under-ignore-older-before-harvesting-is-finished-adjust-your-close--settings-api-1-log/65495 "2016-11-09T13:26:49Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Post date:** [November 9, 2016, 1:26pm UTC](https://discuss.elastic.co/t/err-file-is-falling-under-ignore-older-before-harvesting-is-finished-adjust-your-close--settings-api-1-log/65495/1 "2016-11-09T13:26:49Z")
I am using filebeat 5.0 I am getting these error on filebeat log: 2016-11-09T14:17:32+01:00 ERR Failed to publish events caused by: read tcp 192.168.11.21:42549-\>: read: connection reset by peer 2016-11-09T14:17:32+01:00 INFO Error publishing events (retrying): read tcp 192.168.11.21:42549-\>xxxx: read: connection reset by peer 2016-11-09T14:17:32+01:00 ERR File is falling under ignore\_older before harvesting is finished. Adjust your close\_\* settings: api\_1.log 2016-11-09T14:17:42+01:00 ERR File is falling under ignore\_older before harvesting is finished. Adjust your close\_\* settings: api\_1.log 2016-11-09T14:17:47+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.published\_but\_not\_acked\_events=1668 libbeat.logstash.publish.read\_errors=1 libbeat.logstash.publish.write\_bytes=318 libbeat.logstash.call\_count.PublishEvents=1 2016-11-09T14:19:04+01:00 ERR Failed to publish events caused by: read tcp 192.168.11.21:42622-\>xxxx: i/o timeout 2016-11-09T14:19:04+01:00 INFO Error publishing events (retrying): read tcp 192.168.11.21:42622-\>xxxx: i/o timeout 2016-11-09T14:19:12+01:00 ERR File is falling under ignore\_older before harvesting is finished. Adjust your close\_\* settings: api\_1.log 2016-11-09T14:19:17+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.published\_and\_acked\_events=76 libbeat.logstash.publish.write\_bytes=1499 libbeat.logstash.publish.read\_errors=1 libbeat.logstash.published\_but\_not\_acked\_events=1592 libbeat.logstash.call\_count.PublishEvents=1 IF i restart the service it start sending logs few minutes but stop sending new lines again. Any ideas on the connections timeouts and anf file file failing under ignore\_older. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 10, 2016, 9:10am UTC](https://discuss.elastic.co/t/err-file-is-falling-under-ignore-older-before-harvesting-is-finished-adjust-your-close--settings-api-1-log/65495/2 "2016-11-10T09:10:54Z")
The `ignore_older` messages are related to your output issues. If a file is not completely sent and not closed yet, `ignore_older` will not apply. It seems like there are issues with the connection between your filebeat instance and Logstash. Do you see any errors on the Logstash side? Could you share your config file? ---
**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Post date:** [November 10, 2016, 10:30pm UTC](https://discuss.elastic.co/t/err-file-is-falling-under-ignore-older-before-harvesting-is-finished-adjust-your-close--settings-api-1-log/65495/3 "2016-11-10T22:30:21Z")
After restarting logstash and filebeat and removing registry file i am not getting the errors. Will let you know if i found them again. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 8, 2016, 10:30pm UTC](https://discuss.elastic.co/t/err-file-is-falling-under-ignore-older-before-harvesting-is-finished-adjust-your-close--settings-api-1-log/65495/4 "2016-12-08T22:30:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.