Filebeat process in the server is holding the deleted files which are forwarded by logstash forwarder which makes the server disk space full. Currently a cron job is in place to restart filebeat at regular intervals. But team demands a permanent solution for this. Filebeat version we used is below.
filebeat version 1.2.3 (386)
Below is our filebeat.yml file.
filebeat: prospectors: - paths: - /var/log/apache/*.log input_type: log fields_under_root: true ignore_older: 1h close_older: 30m document_type: logs -
I have tried to enable close_removed flag as well. But that didn't help. Please help in resolving this issue.