[SOLVED] Filebeat keeps open files forever

Filebeat should latest close a file after ignore_older, in your case 5 minutes. With the next major release we will introduce close_older as ignore_older was having to different purposes which could have conflicted: https://github.com/elastic/beats/pull/718

The file is kept open as filebeat doesn't know, if the file only was renamed and it will continue reading, if the file was actually deleted or it just disappeared for a moment.

About force_close_files: The important part is in the second part of the documentation. If you use force_close_files rotated files are only picked up again after scan_frequency. If the file was removed in the meantime and not all log lines were read before rotating, these log lines are lost.

Which filebeat version are you using?