Filebeat high disk usage when reboot server. How fix it?

Hi all!
Filebeat on server send many events from logs of exchange (windows) server to logstash.
When we reboot server filebeat make high disk usage. Other services can't load for a long time.
How can i fix it? Thank you

my config:

setup.ilm.enabled: false "exchange"
setup.template.pattern: "exchange*"
setup.template.overwrite: true
  index.number_of_shards: 3
  index.number_of_replicas: 0
tags: ["exchange-transport"]
  ssl.enabled: true
  hosts: ["elk-server:5044"]
  index: "exchange-%{+YYYY.MM.dd}"
logging.level: info
logging.to_files: true
  path: C:\Program Files\Filebeat\logs
  name: Filebeat.log
  keepfiles: 7
- type: log
  enabled: true
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking\MSGTRK*.LOG
  exclude_lines: ["^#"]
  document_type: exchange           
  ignore_older: 47h  
    type: exchange
  fields_under_root: true

Can you elaborate more on this please. What do you mean, how are you seeing this, how do you know it's Filebeat?

I see this in resource monitor:

How many files are there in that directory?

This folder has a lot of log files, more than 19 thousand

Are they all new files, or are they old ones that have been processed before?

If they are old ones, you may want to look at things like ignore_older and close_inactive.

This is all old, on good need to read only for the last day

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.