# Filebeat 8.1 locks renamed rolling logs forever

**URL:** https://discuss.elastic.co/t/filebeat-8-1-locks-renamed-rolling-logs-forever/300428
**Category:** Beats
**Tags:** filebeat
**Created:** [March 23, 2022, 9:18am UTC](https://discuss.elastic.co/t/filebeat-8-1-locks-renamed-rolling-logs-forever/300428 "2022-03-23T09:18:59Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![alytkowski](https://avatars.discourse-cdn.com/v4/letter/a/cc9497/32.png) [@alytkowski](https://discuss.elastic.co/u/alytkowski)
#### Post date: [March 23, 2022, 9:18am UTC](https://discuss.elastic.co/t/filebeat-8-1-locks-renamed-rolling-logs-forever/300428/1 "2022-03-23T09:18:59Z")

</div>

After switching from Filebeat 7.17 to Filebeat 8.1 and introducing type filestream into our configuration, it seems that Filebeat locks renamed logs forever, causing disk space issues.  
We have a log4j based logs that roll over once reach 20MB, max 12 files.  
Once the log is rolled, we noticed that there are hidden files created like below:  
.nfs00000000000a0002000025a1

These files exist until Filebeat is restarted. I've just cleared 10GB of data just by restarting Filebeat.

A snippet (edited paths for security reasons) of our config:

```auto
filebeat.inputs:
- type: filestream
  enabled: true
  paths:
   - /path/to/logs/integration/Integration.log
  parsers:
  - multiline:
      type: pattern
      pattern: '^\[[0-9]{2}-[0-9]{2}-[0-9]{2}[[:space:]]+[0-9]{2}:[0-9]{2}:[0-9]{2}'
      negate: true
      match: after
  exclude_lines: ['Software', 'xml']
  name: integ2_uat
  tags: ["integ2_uat-logs"]
  ignore_older: 24h
- type: filestream
  enabled: true
  paths:
   - /path/to/logs/jboss_integration/server.log
  parsers:
  - multiline:
      type: pattern
      pattern: '^\[[0-9]{2}-[0-9]{2}-[0-9]{2}[[:space:]]+[0-9]{2}:[0-9]{2}:[0-9]{2}'
      negate: true
      match: after
  exclude_lines: ['Software']
  name: integ2_uat
  tags: ["integ2_uat-logs_server"]
  ignore_older: 24h

```

This behavior didn't occur before v8.1.  
Which option would you advise to include in the configuration, avoiding any data loss?

---

<div class="post-metadata">

### Author: ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [March 24, 2022, 2:58pm UTC](https://discuss.elastic.co/t/filebeat-8-1-locks-renamed-rolling-logs-forever/300428/2 "2022-03-24T14:58:11Z")

</div>

What OS/platform are you using to run Filebeat?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 21, 2022, 4:58pm UTC](https://discuss.elastic.co/t/filebeat-8-1-locks-renamed-rolling-logs-forever/300428/3 "2022-04-21T16:58:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.