# Filebeat keeps files open uses up disk space
**URL:** https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841
**Category:** Beats
**Tags:** filebeat
**Created:** [July 20, 2018, 7:20am UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841 "2018-07-20T07:20:01Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@GioXmen](https://discuss.elastic.co/u/GioXmen)
#### Post date: [July 20, 2018, 7:20am UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841/1 "2018-07-20T07:20:01Z")
Hello,
I am trying to figure out why Filebeat keeps incoming log files open. When Logstash gets full, Filebeat will **keep files open** thus **using up disk space** and eventually eating it up. I would like to find a way to have it terminate the Logstash operation and ensure that the files are closed. Partial data loss may happen, which is a non-issue.
Thank you for reading!
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [July 23, 2018, 9:49am UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841/2 "2018-07-23T09:49:47Z")
Filebeat keeps input files open, because it is waiting for an ACK from Logstash to acknowledge that the events were sent. The input files are open until EOF is reached, events are acknowledged and the states in the registry file is updated. To avoid keeping files open use `close_timeout` in your input configuration.
See more: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-close-timeout](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-close-timeout)
---
### Author:  [@GioXmen](https://discuss.elastic.co/u/GioXmen)
#### Post date: [July 24, 2018, 2:07pm UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841/3 "2018-07-24T14:07:04Z")
How can I check if close\_timeout is working? The debug log has too many messages so I can't see it happen, I set close\_timeout to 1m to be able to see it, but I still can't find the event. The "info" setting for logs does not show it.
How do I find the close\_timeout in the log files?
For eg: "Closing harvester because close\_timeout was reached:" or something like that?. I must confirm it works.
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [July 25, 2018, 8:40am UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841/4 "2018-07-25T08:40:47Z")
Excatly. `"Closing harvester because close_timeout was reached"` is the line you are looking for.
---
### Author:  [@GioXmen](https://discuss.elastic.co/u/GioXmen)
#### Post date: [July 26, 2018, 7:49am UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841/5 "2018-07-26T07:49:34Z")
Strange thing is, that even after adding close\_timeout: 5m to the last line of the config file (" /etc/filebeat/filebeat.yml"), the timeout never happens and the same issues continue to happen 😕
Do I have to add the line to filebeat.full.yml AND OR filebeat.reference.yml ?
My filebeat config (removed personal domains and etc...):
#=========================== Filebeat prospectors =============================
filebeat.prospectors:
- type: log
#============================= Filebeat modules ===============================
filebeat.config.modules:
path: ${path.config}/modules.d/\*.yml
reload.enabled: true
#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["[host.com:5043](http://host.com:5043)"]
#=========================== Harvester closing options ========================
close\_renamed: true
close\_timeout: 5m
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [July 26, 2018, 8:17am UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841/6 "2018-07-26T08:17:46Z")
`close_timeout` is an option of `prospectors`, so you need to add it to `filebeat.prospectors` otherwise it is not working. Your structure of config is half correct. It is true that `close_timeout` is a `harvester` config, but `harvesters` are the "worker theards" of `prospectors`, thus you configure them in the `prospectors` section. So each `harvester` of a `prospector` behaves the same and different `prospectors` can have different `harvester` settings.
```auto
#=========================== Filebeat prospectors =============================
filebeat.prospectors:
type: log
enabled: true
paths:
- /xxx/xxx/xxx
document_type: syslog
close_renamed: true
close_timeout: 5m
#============================= Filebeat modules ===============================
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: true
#================================ Outputs=====================================
#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["host.com:5043"]
#=========================== Harvester closing options ========================
```
---
### Author:  [@GioXmen](https://discuss.elastic.co/u/GioXmen)
#### Post date: [July 26, 2018, 8:22am UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841/7 "2018-07-26T08:22:00Z")
Thanks! that was probably the correct solution! Will update the thread if this worked!
P.S: Does "Closing harvester because close\_timeout was reached" in the logs, if I set log type to "info"?
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [July 30, 2018, 10:13am UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841/8 "2018-07-30T10:13:12Z")
Yes, it shows up at INFO level.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 27, 2018, 10:15am UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841/9 "2018-08-27T10:15:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.