I've noticed problem with logs shipping from heavily written files:
2016-07-18T13:15:24+02:00 DBG Not harvesting, file didn't change: /var/log/app.log
2016-07-18T13:15:24+02:00 DBG Update existing file for harvesting: /var/log/app.log
but after few seconds filebeat send a few logs from before 30 minutes. Next again "Not harvesting, file didn't change", and after few seconds again sends some logs.
I've tried to remove registry file with tail_files option, and after ~15 seconds of normal log shipping filebeat again send logs lazy as above.
Filebeat 1.2.3 on CentOS 7. Installed from official RPM package.