# Filebeat is not closing files and open\_files count keeps on increasing
**URL:** https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344
**Category:** Beats
**Tags:** filebeat
**Created:** [February 15, 2021, 6:06pm UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344 "2021-02-15T18:06:19Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@abhishekkene](https://discuss.elastic.co/u/abhishekkene)
#### Post date: [February 15, 2021, 6:06pm UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344/1 "2021-02-15T18:06:19Z")
The disk space on server shows full and when I checked the Filebeat logs, it was showing the open\_files as quite big number, it is continously increasing. The logs are rolling continously and new log file is being created nearly every 2 mins. I 've given the Close\_inactive to 1m and it is closing the log file as well but it is not able to close all the log files and few log files are remaining open, which result into increase in disk space. If I restart the Filebeat service then the open\_files count goes down and disk space on server as well. Can you please help me in identifing the issue. Please find the current configuration of my filebeat.yml and ymls under input.d folder.
/etc/filebeat/filebeat.yml:::
filebeat.config:
inputs:
enabled: true
path: inputs.d/\*yml
reload.enabled: true
reload.period: 10s
setup.template.settings:
index.number\_of\_shards: 1
/etc/filebeat/inputs.d/modulename.yml::::
- type: log
paths:
- /modulename.log
scan\_frequency: 10s
fields:
service: modulename
env: dev
multiline.type: pattern
multiline.pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}
multiline.negate: true
multiline.match: after
close\_inactive: 1m
close\_removed: true
clean\_removed: true
---
### Author:  [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [February 16, 2021, 11:50am UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344/2 "2021-02-16T11:50:02Z")
Please, can you paste your configuration in yaml format using common markdown syntax? It's common to have indentation mistakes and nobody will see them if it's not correctly formatted.
Apart from that, if everything is ok, I suggest to start removing config lines one by one to see if it gets fixed this way. If so, you have a mistake in your config (maybe a multiline that never closes)
---
### Author:  [@abhishekkene](https://discuss.elastic.co/u/abhishekkene)
#### Post date: [February 16, 2021, 1:11pm UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344/3 "2021-02-16T13:11:49Z")
Please find the yaml files.
/etc/filebeat/filebeat.yml:::
```
filebeat.config:
inputs:
enabled: true
path: inputs.d/*yml
reload.enabled: true
reload.period: 10s
setup.template.settings:
index.number_of_shards: 1
```
/etc/filebeat/inputs.d/modulename.yml::::
```
- type: log
paths:
- /modulename.log
scan_frequency: 10s
fields:
service: modulename
env: dev
multiline.type: pattern
multiline.pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}
multiline.negate: true
multiline.match: after
close_inactive: 1m
close_removed: true
clean_removed: true
```
Can you please explain more on your comments about multiline never close. How can I check that?
---
### Author:  [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [February 16, 2021, 2:57pm UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344/4 "2021-02-16T14:57:31Z")
I mean try the most bare bones Filebeat config and if the problem persists, Filebeat might have a bug that hasn't been reported yet. It's unlikely because it's the core of Filebeat and other reports will be known yet.
If not, it's something that you are misinterpreting in the config. For example, the multiline pattern might match the very first line of your logs but unexpectedly nothing later. This may be a wrong regex or your logs don't have the shape you are thinking.
Edit: To clarify, I'm not saying that the multiline you have wrote is incorrect, I'm saying that you should try removing config options and check if everything works. Then keep adding config lines one by one until it breaks again.
---
### Author:  [@abhishekkene](https://discuss.elastic.co/u/abhishekkene)
#### Post date: [February 17, 2021, 4:24am UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344/5 "2021-02-17T04:24:43Z")
I 've tried removing the multiline as per your suggestion but no luck.
The open\_files count is keep on increasing. I'm not sure whether close\_removed or clean\_removed is being restricted by some other configuration or any additional configuration is required to work them properly. As in my case, the files are getting removed from server but the filebeat is not able to close them. Please suggest.
---
### Author:  [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [February 17, 2021, 9:01am UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344/6 "2021-02-17T09:01:49Z")
Please, try without **any extra** configuration. Activate the module, set your paths, execute and check if you keep having the problem
---
### Author:  [@abhishekkene](https://discuss.elastic.co/u/abhishekkene)
#### Post date: [February 17, 2021, 4:44pm UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344/7 "2021-02-17T16:44:28Z")
I tried with minimum configuration like having just path and scan\_frequency, the count for open\_files are increasing quite fast. So it is clear that it is not failing due to other configuration and close\_inactive is required and set to 1m in case the log files are getting created very quickly like in my case. But if there is way to make sure close\_removed and clean\_removed is working properly that would be great. As I can see in my case the even when the files are removed those are not being removed from filebeat registry and hence might be shown as in open\_files which actually result in consuming diskspace on server. Please suggest the solution to this issue.
---
### Author:  [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [February 19, 2021, 11:48am UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344/8 "2021-02-19T11:48:05Z")
Ok, now we are talking 😄 The reason I was asking you to try a barebones config is because it's often common to misunderstand some config parameter and mess up the system.
Can you provide some more details? I think we need the following:
- Rough number of files being read (and average size of them)
- Rough number of events per file
- Average size of events
- Example log lines of those files.
It can be something very small though, I have seen situations were everything was working like charm until, for some unknown reason, a huge event with a 2 MB single `keyword` field was generated (maybe from some injection attack) which was producing a huge lag in the entire system.
---
### Author:  [@abhishekkene](https://discuss.elastic.co/u/abhishekkene)
#### Post date: [February 19, 2021, 9:11pm UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344/9 "2021-02-19T21:11:28Z")
Please find the details requested:
Number of files being read: 7 (in path: /loglocation/modulename.log)
Number of events : ~15000 events each file
Size of events: Random, mostly 2-3 lines and sometimes stacktrace
Frequency of file creation: 1 new file every 1 or 2 mins
Size of file: 10MB (fixed), once it is reached this size new file will be created
Example:
2021-02-18 23:25:25.360 INFO 24490 --- [hystrix-RestUtility-10] c.g.t.e.m.service.util.RestUtility : Response Body for inventory call from source:::: Ptn Reversal Inventorycall {serviceMaterialId=#######, isSuccess=true, status=SUCCESS, message=Ptn reversal for write off success}
2021-02-18 23:25:25.361 DEBUG 24490 --- [http-nio-9030-exec-3] org.hibernate.SQL : select shoppingca0\_.shopping\_cart\_detail\_id as shopping\_cart\_deta1\_62\_, shoppingca0\_.b2b\_circ7\_code as b2\_62\_, shoppingca0\_.created\_by as created\_by3\_62\_, shoppingca0\_.creation\_date as creation\_date4\_62\_, shoppingca0\_.cust\_item\_price as cust\_item\_price5\_62\_, shoppingca0\_.customer\_part\_number as customer\_part\_numb6\_62\_, shoppingca0\_.defect\_id as defect\_id7\_62\_, shoppingca0\_.deleted\_quantity as deleted\_quantity8\_62\_, shoppingca0\_.dft\_defect\_pick\_flag as dft\_defect\_pick\_fl9\_62\_, shoppingca0\_.dft\_shortage\_comments as dft\_shortage\_comm10\_62\_, shoppingca0\_.dmr\_item\_flag as dmr\_item\_flag11\_62\_, shoppingca0\_.dmr\_quantity\_due as dmr\_quantity\_due12\_62\_, shoppingca0\_.floor\_pick as floor\_pick13\_62\_, shoppingca0\_.fmi\_id as fmi\_id14\_62\_, shoppingca0\_.item\_id\_picked as item\_id\_picked15\_62\_, shoppingca0\_.item\_number\_picked as item\_number\_picke16\_62\_, shoppingca0\_.last\_updated\_by as last\_updated\_by17\_62\_, shoppingca0\_.last\_updated\_date as last\_updated\_date18\_62\_, shoppingca0\_.last\_usage\_date as last\_usage\_date19\_62\_, shoppingca0\_.locator\_id as locator\_id20\_62\_, shoppingca0\_.material\_request\_date as material\_request\_21\_62\_, shoppingca0\_.material\_request\_location as material\_request\_22\_62\_, shoppingca0\_.matl\_requested\_by as matl\_requested\_by23\_62\_, shoppingca0\_.parts\_catalog\_item\_id as parts\_catalog\_ite24\_62\_, shoppingca0\_.parts\_catalog\_item\_number as parts\_catalog\_ite25\_62\_, shoppingca0\_.picked\_quantity as picked\_quantity26\_62\_, shoppingca0\_.po\_line\_number as po\_line\_number27\_62\_, shoppingca0\_.po\_number as po\_number28\_62\_, shoppingca0\_.repeator\_flag as repeator\_flag29\_62\_, shoppingca0\_.request\_source as request\_source30\_62\_, shoppingca0\_.requested\_during\_outage as requested\_during\_31\_62\_, shoppingca0\_.requested\_quantity as requested\_quantit32\_62\_, shoppingca0\_.returned\_quantity as returned\_quantity33\_62\_, shoppingca0\_.service\_item\_id as service\_item\_id34\_62\_, shoppingca0\_.shopping\_cart\_header\_id as shopping\_cart\_hea45\_62\_, shoppingca0\_.shopping\_cart\_status as shopping\_cart\_sta35\_62\_, shoppingca0\_.shopping\_cart\_status\_id as shopping\_cart\_sta36\_62\_, shoppingca0\_.shortage\_comments as shortage\_comments37\_62\_, shoppingca0\_.shortage\_flag as shortage\_flag38\_62\_, shoppingca0\_.shortage\_item\_id as shortage\_item\_id39\_62\_, shoppingca0\_.source\_inv\_code as source\_inv\_code40\_62\_, shoppingca0\_.stock\_locator as stock\_locator41\_62\_, shoppingca0\_.subinventory as subinventory42\_62\_, shoppingca0\_.ux\_item\_flag as ux\_item\_flag43\_62\_, shoppingca0\_.ux\_quantity\_due as ux\_quantity\_due44\_62\_ from ############################## shoppingca0\_ where shoppingca0\_.shopping\_cart\_detail\_id=?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 19, 2021, 11:11pm UTC](https://discuss.elastic.co/t/filebeat-is-not-closing-files-and-open-files-count-keeps-on-increasing/264344/10 "2021-03-19T23:11:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.