Filebeat is not closig the file descriptor and the file descriptors are dangling, when the file is deleted/renamed

Elastic Stack Beats
1

Hi,

We are still facing same issue that file descriptors are dangling.

for reference:

Do we have to update the logstash version from logstash-5.2.1-1.noarch to logstash-5.6

Need your assistance on this issue.

Thanks in Advance,
Swetha.

2

I think to really get to the bottom of this problem we need the full config file you use and the debug log as requested previously.

In general if you want to "force close" files where reading was not finished, you can use the close_timeout config option https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#close-timeout

3

Hi,

We can share the config file.

do you want both filebeat and logstash config file.

Thanks,
Swetha. M

4

So far I would focus on the once from Filebeat. The important part here are the log files.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.