# Filebeat keep reading the file, this blocks the file deletion on the system

**URL:** https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514
**Category:** Beats
**Tags:** filebeat
**Created:** [October 1, 2018, 6:13am UTC](https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514 "2018-10-01T06:13:28Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![Badb0y](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Badb0y](https://discuss.elastic.co/u/Badb0y)
#### Post date: [October 1, 2018, 6:13am UTC](https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514/1 "2018-10-01T06:13:28Z")

</div>

Hi,

We have this configuration:

```
filebeat.prospectors:
- type: log
  enabled: true
  exclude_lines: ['^#']
  paths:
    - D:\dir\logfiles\zip_archive\www.dir.com\*\u*.log
    - D:\dir\logfiles\zip_archive\www81.dir.com\*\u*.log
  fields_under_root: true
  fields:
    type: webreturn
- type: log
  enabled: true
  exclude_lines: ['^#']
  paths:
    - D:\dir\logfiles\zip_archive\http_sys_logs\HTTPERR\h*.log
  fields_under_root: true
  fields:
    type: httperr
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
output.logstash:
  hosts: ["hostslist"]

```

This is running on windows and we have a file deletion in this folder, so all files that is older than 2 days got deleted.  
However filebeat is still reading the file and it prevents to delete it.  
How can I set it to let the task scheduler delete it?

I'm using 6.2.4 version.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 1, 2018, 6:19am UTC](https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514/2 "2018-10-01T06:19:54Z")

</div>

Have you looked at the [configuration parameters related to closing files](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-close-options)?

---

<div class="post-metadata">

### Author: ![Badb0y](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Badb0y](https://discuss.elastic.co/u/Badb0y)
#### Post date: [October 1, 2018, 6:24am UTC](https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514/3 "2018-10-01T06:24:35Z")

</div>

Yes, but don't know which and how to implement? The close\_inactive? Or ?

---

<div class="post-metadata">

### Author: ![Badb0y](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Badb0y](https://discuss.elastic.co/u/Badb0y)
#### Post date: [October 1, 2018, 6:24am UTC](https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514/4 "2018-10-01T06:24:44Z")

</div>

> [@Badb0y](#):
>
> Yes, but don't know which and how to implement? The close\_inactive? Or ?

Yes, but don't know which and how to implement? The close\_inactive? Or ?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 1, 2018, 6:27am UTC](https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514/5 "2018-10-01T06:27:37Z")

</div>

I do not know the lifecycle of your files or how long they are written to, but `close_inactive` might certainly be an option.

---

<div class="post-metadata">

### Author: ![Badb0y](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Badb0y](https://discuss.elastic.co/u/Badb0y)
#### Post date: [October 8, 2018, 8:25am UTC](https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514/6 "2018-10-08T08:25:06Z")

</div>

This one doesn't work.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 8, 2018, 9:07am UTC](https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514/7 "2018-10-08T09:07:57Z")

</div>

What does your config look like now? What exactly does not work?

---

<div class="post-metadata">

### Author: ![Badb0y](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Badb0y](https://discuss.elastic.co/u/Badb0y)
#### Post date: [October 8, 2018, 9:13am UTC](https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514/8 "2018-10-08T09:13:12Z")

</div>

```
filebeat.prospectors:
- type: log
  close_inactive: 60m
  enabled: true
  exclude_lines: ['^#']
  paths:
    - D:\a\logfiles\zip_archive\www.aa.com\*\u*.log
    - D:\a\logfiles\zip_archive\www81.aa.com\*\u*.log
  fields_under_root: true
  fields:
    type: webreturn
  ignore_older: 24h
- type: log
  close_inactive: 60m
  enabled: true
  exclude_lines: ['^#']
  paths:
    - D:\a\logfiles\zip_archive\http_sys_logs\HTTPERR\h*.log
  fields_under_root: true
  fields:
    type: httperr
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
output.logstash:
  hosts: ["hosts"]
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 5, 2018, 9:13am UTC](https://discuss.elastic.co/t/filebeat-keep-reading-the-file-this-blocks-the-file-deletion-on-the-system/150514/9 "2018-11-05T09:13:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
