Excessive Disk usage - Filebeat

Hi,

i'm using elk stack of version 5.5 without x-pack.

My disk is getting filled even though my file is deleted , filebeat still has the file handler open, the file disappears but still takes up space on my disk.

so i decided use the following properties
"close_inactive" or " ignore_older"
and i'm confused to which one to choose

what i exactly want :

if a file is inactive for 1 day
i want to close that file
if there is new log enters to that file
will filebeat reopen that file ?

so please help me understand which property is suitable for my usecase.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.