We are experiencing issues daily with lingering open file handles on files which have been deleted by another process which has completed daily compression of logs.
The files seem to remain open forever until we manually restart the filebeat process.
Config example here:
- type: log enabled: true paths: - /logs/<app-name>/**/*.json.log fields: format: json ...more custom fields...
From the docs,
close_inactive doesn't get included by default, but then it kinda does? I'm having a hard time confirming that.
When this option is enabled...
...The default is 5m.
If a file was "deleted" but then has no activity on it after being deleted, the handle should be closed if that "close_inactive" was defaulted to true. That deleted file should really have been deleted then, and the harvester should have no longer been able to find it....
I'm looking for confirmation on the behavior of the process when
close_inactive is not set at all for any of the inputs.