# Filebeat holding deleted files which consumes disk space

**URL:** <https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 29, 2017, 8:19am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415 "2017-05-29T08:19:06Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![arya](https://avatars.discourse-cdn.com/v4/letter/a/a4c791/32.png) [@arya](https://discuss.elastic.co/u/arya)\
**Post date:** [May 29, 2017, 8:19am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415/1 "2017-05-29T08:19:06Z")

</div>

Filebeat process in the server is holding the deleted files which are forwarded by logstash forwarder which makes the server disk space full. Currently a cron job is in place to restart filebeat at regular intervals. But team demands a permanent solution for this. Filebeat version we used is below.  
filebeat version 1.2.3 (386)

Below is our filebeat.yml file.

```
filebeat:
      prospectors:
        -
          paths:
            - /var/log/apache/*.log

          input_type: log

          fields_under_root: true
          ignore_older: 1h
          close_older: 30m
          document_type: logs
        -

```

I have tried to enable close\_removed flag as well. But that didn't help. Please help in resolving this issue.

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [May 29, 2017, 8:22am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415/2 "2017-05-29T08:22:15Z")

</div>

@arya For a more permanent solution, I recommend upgrading to Filebeat 5.4 (it's compatible with ES 2.x) and use the [close\_timeout](https://www.elastic.co/guide/en/beats/filebeat/5.4/configuration-filebeat-options.html#close-timeout) option. Set it to a value higher than your rotation interval.

Also, consider that if Filebeat is holding onto files for so long, it means that the output is often blocked. Perhaps your Logstash/Elasticsearch clusters are under-provisioned?

---

<div class="post-metadata">

**Author:** ![arya](https://avatars.discourse-cdn.com/v4/letter/a/a4c791/32.png) [@arya](https://discuss.elastic.co/u/arya)\
**Post date:** [May 29, 2017, 8:33am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415/3 "2017-05-29T08:33:38Z")

</div>

Thanks Tudor.

So version 1.2.3 doesn't support close\_timeout option?  
This problem is there only for files which are deleted. All the other files getting forwarded successfully. So that means Logstash/Elasticsearch clusters working as expected right?

---

<div class="post-metadata">

**Author:** ![arya](https://avatars.discourse-cdn.com/v4/letter/a/a4c791/32.png) [@arya](https://discuss.elastic.co/u/arya)\
**Post date:** [May 30, 2017, 7:15am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415/4 "2017-05-30T07:15:39Z")

</div>

Hi ,

Will filebeat locks the files if logstash is down in the receiving end? I couldnot telnet from my filebeat server to logstash.

Regards,  
Arya

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [May 30, 2017, 8:07am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415/5 "2017-05-30T08:07:28Z")

</div>

If `close_timeout` is not set, a blocking output can cause Filebeat to keep the files open forever, which means the OS can't delete them. Does that answer the question?

---

<div class="post-metadata">

**Author:** ![arya](https://avatars.discourse-cdn.com/v4/letter/a/a4c791/32.png) [@arya](https://discuss.elastic.co/u/arya)\
**Post date:** [May 30, 2017, 8:41am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415/6 "2017-05-30T08:41:58Z")

</div>

yes.. thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2017, 8:42am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415/7 "2017-06-27T08:42:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.