# Filebeat configuration for handling high file creation rate and small file sizes version 7.17

**URL:** <https://discuss.elastic.co/t/filebeat-configuration-for-handling-high-file-creation-rate-and-small-file-sizes-version-7-17/360955>\
**Category:** Elasticsearch\
**Created:** [June 6, 2024, 11:48am UTC](https://discuss.elastic.co/t/filebeat-configuration-for-handling-high-file-creation-rate-and-small-file-sizes-version-7-17/360955 "2024-06-06T11:48:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Danyal\_Danish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danyal_danish/32/131444_2.png) [@Danyal\_Danish](https://discuss.elastic.co/u/Danyal_Danish)\
**Post date:** [June 6, 2024, 11:48am UTC](https://discuss.elastic.co/t/filebeat-configuration-for-handling-high-file-creation-rate-and-small-file-sizes-version-7-17/360955/1 "2024-06-06T11:48:16Z")

</div>

Can Filebeat be configured for handling high file creation rate (10 - 15 files per second) and for small file sizes of (500kb per file) version 7.17. My actual question is that what specific input type is preferable for this ? filestream input or anything else. I have read the documentation on this but I'm still a little confused. TIA

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 6, 2024, 1:30pm UTC](https://discuss.elastic.co/t/filebeat-configuration-for-handling-high-file-creation-rate-and-small-file-sizes-version-7-17/360955/2 "2024-06-06T13:30:46Z")

</div>

There is not much to choose, to read files you have 2 inputs, `filestream` and `log`, the `log` input is deprecated and the recommendation is to use the `filestream` input.

---

<div class="post-metadata">

**Author:** ![Danyal\_Danish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danyal_danish/32/131444_2.png) [@Danyal\_Danish](https://discuss.elastic.co/u/Danyal_Danish)\
**Post date:** [June 6, 2024, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-configuration-for-handling-high-file-creation-rate-and-small-file-sizes-version-7-17/360955/3 "2024-06-06T13:54:04Z")

</div>

One more question about file rotation. Considering my scenario, should I use a file rotation strategy at all and if I should, then create and rename strategy would be a better choice?