Have the same issue. Old logs are rename each hour, then delete after hour of inactivity by script. But filebeat still keep all or many of them open. Can't reproduce in test lab, only on prod get it. Maybe it's related to intensive of logging.
Config:
filebeat.prospectors:
- input_type: log
paths:
- /var/log/batch/Batch*-running.log
close_inactive: 5m
close_renamed: true
clean_removed: true
close_removed is enabled by default (according to official documentation)
filebeat-5.6.3-1.x86_64
Red Hat Enterprise Linux Server release 6.7