# Filebeat high disk usage when reboot server. How fix it?

**URL:** <https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 18, 2020, 5:06pm UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876 "2020-11-18T17:06:15Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrew\_Foxis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_foxis/32/69811_2.png) [@Andrew\_Foxis](https://discuss.elastic.co/u/Andrew_Foxis)\
**Post date:** [November 18, 2020, 5:06pm UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876/1 "2020-11-18T17:06:16Z")

</div>

Hi all!  
Filebeat on server send many events from logs of exchange (windows) server to logstash.  
When we reboot server filebeat make high disk usage. Other services can't load for a long time.  
How can i fix it? Thank you

my config:

```auto
setup.ilm.enabled: false
setup.template.name: "exchange"
setup.template.pattern: "exchange*"
setup.template.overwrite: true
setup.template.settings:
  index.number_of_shards: 3
  index.number_of_replicas: 0
tags: ["exchange-transport"]
output.logstash:
  ssl.enabled: true
  hosts: ["elk-server:5044"]
  index: "exchange-%{+YYYY.MM.dd}"
logging.level: info
logging.to_files: true
logging.files:
  path: C:\Program Files\Filebeat\logs
  name: Filebeat.log
  keepfiles: 7
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking\MSGTRK*.LOG
  exclude_lines: ["^#"]
  document_type: exchange           
  ignore_older: 47h  
  fields:
    type: exchange
  fields_under_root: true

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 18, 2020, 9:43pm UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876/2 "2020-11-18T21:43:25Z")

</div>

> [@Andrew\_Foxis](#):
>
> When we reboot server filebeat make high disk usage

Can you elaborate more on this please. What do you mean, how are you seeing this, how do you know it's Filebeat?

---

<div class="post-metadata">

**Author:** ![Andrew\_Foxis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_foxis/32/69811_2.png) [@Andrew\_Foxis](https://discuss.elastic.co/u/Andrew_Foxis)\
**Post date:** [November 19, 2020, 7:03am UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876/3 "2020-11-19T07:03:41Z")

</div>

I see this in resource monitor:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed9c6234d0e5090b6b167c7c1326d412f057374d.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 19, 2020, 7:42am UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876/4 "2020-11-19T07:42:03Z")

</div>

> [@Andrew\_Foxis](#):
>
> ```auto
> - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking\MSGTRK*.LOG
> 
> ```

How many files are there in that directory?

---

<div class="post-metadata">

**Author:** ![Andrew\_Foxis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_foxis/32/69811_2.png) [@Andrew\_Foxis](https://discuss.elastic.co/u/Andrew_Foxis)\
**Post date:** [November 19, 2020, 8:43am UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876/5 "2020-11-19T08:43:59Z")

</div>

This folder has a lot of log files, more than 19 thousand

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 19, 2020, 9:21am UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876/6 "2020-11-19T09:21:16Z")

</div>

Are they all new files, or are they old ones that have been processed before?

If they are old ones, you may want to look at things like [`ignore_older`](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-ignore-older) and [`close_inactive`](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-close-inactive).

---

<div class="post-metadata">

**Author:** ![Andrew\_Foxis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_foxis/32/69811_2.png) [@Andrew\_Foxis](https://discuss.elastic.co/u/Andrew_Foxis)\
**Post date:** [November 19, 2020, 9:23am UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876/7 "2020-11-19T09:23:14Z")

</div>

@warkolm  
This is all old, on good need to read only for the last day

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2020, 11:23am UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876/8 "2020-12-17T11:23:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.