As long as events are not acked by the receiving end filebeat will not release the file handler as this could lead to data loss. If you want filebeat to force closing your files after a certain time use close_timeout: https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filebeat-options.html#close-timeout If you use this feature it is important that you understand the side effects.