Hi,
i'm using elk stack of version 5.5 without x-pack.
My disk is getting filled even though my file is deleted , filebeat still has the file handler open, the file disappears but still takes up space on my disk.
so i decided use the following properties
"close_inactive" or " ignore_older"
and i'm confused to which one to choose
what i exactly want :
if a file is inactive for 1 day
i want to close that file
if there is new log enters to that file
will filebeat reopen that file ?
so please help me understand which property is suitable for my usecase.