### Author:  [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)
#### Post date: [September 14, 2017, 3:27pm UTC](https://discuss.elastic.co/t/filebeat-holding-old-files-in-centos-6-5/100571/1 "2017-09-14T15:27:52Z")
Hi not sure it bug but filebeat is killing space on filesystem one I do restart filebeat system get back to normal
can some one please why filebeat stuck to old files I'm running 5.5.2 version ?
>
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 4, 2017, 10:10am UTC](https://discuss.elastic.co/t/filebeat-holding-old-files-in-centos-6-5/100571/2 "2017-10-04T10:10:08Z")
Filebeat is supposed to tail log files. As content can be appended to log files at any time, filebeat keeps the files open for some time, checking for new contents. As log files can be removed/rotated-out, closing the file early can lead to data-loss. That's why the file is kept open.
Have a look at at the different [file closing settings in the docs](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#close-options)
On all OSes a file being deleted is only deleted for sure, once no more process is accessing the file.
---
### Author:  [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)
#### Post date: [October 4, 2017, 3:53pm UTC](https://discuss.elastic.co/t/filebeat-holding-old-files-in-centos-6-5/100571/3 "2017-10-04T15:53:28Z")
Hi Steffens,
Thanks for your suggestion I have made the filebeat yml below configuration looks my issue is still on going on
root@hostname ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 130G 130G 0 100% /
tmpfs 95G 5.7M 95G 1% /dev/shm
/dev/sda1 485M 32M 428M 7% /boot
after filebeat restart
[root@hostname /]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 130G 106G 18G 86% /
tmpfs 95G 5.7M 95G 1% /dev/shm
/dev/sda1 485M 32M 428M 7% /boot (edited)
filebeat yml configuration
- input\_type: log
paths:
- /opt/trafficserver/var/log/trafficserver/traffic.out
document\_type: traffic
close\_renamed : true
close\_inactive : 10m
- input\_type: log
paths:
Thanks in advance Ravi
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 5, 2017, 9:44am UTC](https://discuss.elastic.co/t/filebeat-holding-old-files-in-centos-6-5/100571/4 "2017-10-05T09:44:00Z")
Are these files written once or is more contents append at any time?
How big are those files?
How fast are they rotated?
Maybe `10m` is still to big? You can also try `close_eof` to force filebeat to close the file handle every time the end of file is reached. If more contents is added to the file, filebeat will reopen and continue processing.
---
### Author:  [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)
#### Post date: [October 5, 2017, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-holding-old-files-in-centos-6-5/100571/5 "2017-10-05T15:03:46Z")
> [@steffens](#):
>
> close\_eof
Thanks for your advice Steffens I have made the change this morning will monitor till next 3 days and see if the issue still exists and also my I'm harvesting from 14 sources with individual paths each file is about 30m to 300m which is really huge I know..
Sample configuration now is
- input\_type: log
paths:
- input\_type: log
paths:
Thanks / Ravi
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 5, 2017, 3:28pm UTC](https://discuss.elastic.co/t/filebeat-holding-old-files-in-centos-6-5/100571/6 "2017-10-05T15:28:00Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 6, 2017, 10:13am UTC](https://discuss.elastic.co/t/filebeat-holding-old-files-in-centos-6-5/100571/7 "2017-10-06T10:13:04Z")
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 4:58am UTC](https://discuss.elastic.co/t/filebeat-holding-old-files-in-centos-6-5/100571/8 "2022-11-04T04:58:21Z")