a FileBeat on one of our machines started giving this error:
ERROR log/input.go:222 input state for C:\tmp\InstalledPrograms.log was not removed: CreateFile C:\tmp\InstalledPrograms.log: Access is denied. INFO log/harvester.go:270 File was removed: C:\tmp\InstalledPrograms.log. Closing because close_removed is enabled.
There is definitely access to this file and the harvester was able to collect info a few days ago. Also, there are other machines which are able to collect data from the same location.
Any idea what might have caused this?