# Filebeat - 10000s of messages "Reader was closed. Closing.#011" flooding log
**URL:** https://discuss.elastic.co/t/filebeat-10000s-of-messages-reader-was-closed-closing-011-flooding-log/329088
**Category:** Beats
**Tags:** filebeat
**Created:** [April 1, 2023, 12:18am UTC](https://discuss.elastic.co/t/filebeat-10000s-of-messages-reader-was-closed-closing-011-flooding-log/329088 "2023-04-01T00:18:49Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Alex\_Stuck](https://discuss.elastic.co/u/Alex_Stuck)
#### Post date: [April 1, 2023, 12:18am UTC](https://discuss.elastic.co/t/filebeat-10000s-of-messages-reader-was-closed-closing-011-flooding-log/329088/1 "2023-04-01T00:18:49Z")
Hey there
Subject says it all. I have a simple filebeat agent pointing to some other team's LS that I don't control. I get spammed with the following line at a rate of up to 1000/minute and it doesn't stop. Here an example of 10 within 1 second.
```auto
2023-03-31T23:57:49.607784+00:00 syslog-c01n01 filebeat[25349]: 2023-03-31T23:57:49.607Z INFO [input.filestream] map[file.line:321 file.name:filestream/input.go] Reader was closed. Closing.#011{"ecs.version": "1.6.0"}
2023-03-31T23:57:49.628766+00:00 syslog-c01n01 filebeat[25349]: 2023-03-31T23:57:49.628Z INFO [input.filestream] map[file.line:321 file.name:filestream/input.go] Reader was closed. Closing.#011{"ecs.version": "1.6.0"}
2023-03-31T23:57:49.628785+00:00 syslog-c01n01 filebeat[25349]: 2023-03-31T23:57:49.628Z INFO [input.filestream] map[file.line:321 file.name:filestream/input.go] Reader was closed. Closing.#011{"ecs.version": "1.6.0"}
2023-03-31T23:57:49.630121+00:00 syslog-c01n01 filebeat[25349]: 2023-03-31T23:57:49.630Z INFO [input.filestream] map[file.line:321 file.name:filestream/input.go] Reader was closed. Closing.#011{"ecs.version": "1.6.0"}
2023-03-31T23:57:49.631337+00:00 syslog-c01n01 filebeat[25349]: 2023-03-31T23:57:49.631Z INFO [input.filestream] map[file.line:321 file.name:filestream/input.go] Reader was closed. Closing.#011{"ecs.version": "1.6.0"}
2023-03-31T23:57:49.632751+00:00 syslog-c01n01 filebeat[25349]: 2023-03-31T23:57:49.632Z INFO [input.filestream] map[file.line:321 file.name:filestream/input.go] Reader was closed. Closing.#011{"ecs.version": "1.6.0"}
2023-03-31T23:57:49.634455+00:00 syslog-c01n01 filebeat[25349]: 2023-03-31T23:57:49.634Z INFO [input.filestream] map[file.line:321 file.name:filestream/input.go] Reader was closed. Closing.#011{"ecs.version": "1.6.0"}
2023-03-31T23:57:49.639994+00:00 syslog-c01n01 filebeat[25349]: 2023-03-31T23:57:49.639Z INFO [input.filestream] map[file.line:321 file.name:filestream/input.go] Reader was closed. Closing.#011{"ecs.version": "1.6.0"}
2023-03-31T23:57:49.641195+00:00 syslog-c01n01 filebeat[25349]: 2023-03-31T23:57:49.641Z INFO [input.filestream] map[file.line:321 file.name:filestream/input.go] Reader was closed. Closing.#011{"ecs.version": "1.6.0"}
2023-03-31T23:57:49.642599+00:00 syslog-c01n01 filebeat[25349]: 2023-03-31T23:57:49.642Z INFO [input.filestream] map[file.line:321 file.name:filestream/input.go] Reader was closed. Closing.#011{"ecs.version": "1.6.0"}
```
1. What does this mean ?
2. Why is it always "#011"
3. What does #011 refer to ?
thx
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 1, 2023, 3:15am UTC](https://discuss.elastic.co/t/filebeat-10000s-of-messages-reader-was-closed-closing-011-flooding-log/329088/2 "2023-04-01T03:15:50Z")
The beats are pretty noisy and will spam your system logs since per default they log to stdout.
My suggestion is to edit your `filebeat.yml` to log to a file and change the log level to warning with the following config.
```auto
logging.level: warning
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0640
```
If I'm not wrong I tink that your log basically means that it finished reading a file.
The `#011` part is just the ASCII code for the tab character in octal.
---
### Author:  [@Alex\_Stuck](https://discuss.elastic.co/u/Alex_Stuck)
#### Post date: [April 1, 2023, 5:35am UTC](https://discuss.elastic.co/t/filebeat-10000s-of-messages-reader-was-closed-closing-011-flooding-log/329088/3 "2023-04-01T05:35:26Z")
Only one problem. This also disables the monitoring json output that u get every 30s under log level info. I'm using that to graph all the beats stats ☹
This #011 bit looks like it should be only part of debug logging in my opinion.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 1, 2023, 6:16am UTC](https://discuss.elastic.co/t/filebeat-10000s-of-messages-reader-was-closed-closing-011-flooding-log/329088/4 "2023-04-01T06:16:44Z")
Interesting here is the line of code.
Looks like this should be classified as an ERROR...
>
@andrewkroh ^ Looks like ERROR Message as INFO also is this an actual error or just normal closing of files.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 4, 2023, 11:55am UTC](https://discuss.elastic.co/t/filebeat-10000s-of-messages-reader-was-closed-closing-011-flooding-log/329088/5 "2023-04-04T11:55:13Z")
That looks like a message relating to the normal operation of the input. The input will close the reader for several reason such as the file has been inactive for a period of time (it will reopen after it sees changes). I think it would be better to have that a the debug level (and perhaps have some metrics related to the reader instances that can show what's happening over time).
Can you open a [github issue](https://github.com/elastic/beats/issues/new/choose) for log spam problem coming from this line.
> [@Alex\_Stuck](#):
>
> This also disables the monitoring json output that u get every 30s under log level info. I'm using that to graph all the beats stats
Filebeat has an HTTP API that can return metrics if you don't want to (or can't) scrape them from logs. See [Configure an HTTP endpoint for metrics | Filebeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/http-endpoint.html#_stats).
---
### Author:  [@Alex\_Stuck](https://discuss.elastic.co/u/Alex_Stuck)
#### Post date: [April 5, 2023, 5:31am UTC](https://discuss.elastic.co/t/filebeat-10000s-of-messages-reader-was-closed-closing-011-flooding-log/329088/6 "2023-04-05T05:31:28Z")
Done
>
>
> Hey there
> I was asked to file an issue regarding this discussion:
>
> https://di…scuss.elastic.co/t/filebeat-10000s-of-messages-reader-was-closed-closing-011-flooding-log/329088
>
> Filebeat agent version 8.6.2
>
> Simple config example
> \`\`\`
> logging.level: info
> logging.to\_syslog: true
>
> filebeat.config.modules:
> path: ${path.config}/modules.d/\*.yml
> reload.enabled: false
>
> filebeat.inputs:
> \- type: filestream
> id: log
> enabled: true
> paths:
> - /log/\*\*/\*
>
> output.logstash:
> hosts: \["beats-host.domain.com:5044"\]
> ssl.enabled: true
>
> processors:
> - add\_fields:
> target: "@socat"
> fields:
> token: "1234zxc"
> \`\`\`
>
> thx
thx
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 3, 2023, 7:32am UTC](https://discuss.elastic.co/t/filebeat-10000s-of-messages-reader-was-closed-closing-011-flooding-log/329088/7 "2023-05-03T07:32:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.