Troy your response is very helpful and confirms my understanding.
First, the plan is to remove the files, but only after they have been removed from the registry.
My last post is my current problem...the files aren't being removed from the registry, even though the "three minutes" has passed. Your post confirmed that they should be.
I'm not even sure I want\need the ignore_older
setting, but I can't comment it out since clean_inactive
needs it and will Filebeat will complain if it's missing. If I extend it, it will conflict with clean_inactive
which is supposed to be longer than ignore_older + scan_frequency
.