Filebeat is not closing files, cause it hasn't finished processing them yet. There are a number of close options per prospector. If filebeat is blocked by stale outputs, the most aggressive is close_timeout, which force kills a harvester (file reading process) every N seconds.