# Filebeat / kubernetes / data loss

**URL:** <https://discuss.elastic.co/t/filebeat-kubernetes-data-loss/258322>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 10, 2020, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-kubernetes-data-loss/258322 "2020-12-10T18:53:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![elastic\_user1](https://avatars.discourse-cdn.com/v4/letter/e/5f9b8f/32.png) [@elastic\_user1](https://discuss.elastic.co/u/elastic_user1)\
**Post date:** [December 10, 2020, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-kubernetes-data-loss/258322/1 "2020-12-10T18:53:31Z")

</div>

I am using following config [https://raw.githubusercontent.com/elastic/beats/master/deploy/kubernetes/filebeat-kubernetes.yaml](https://raw.githubusercontent.com/elastic/beats/master/deploy/kubernetes/filebeat-kubernetes.yaml) plus settings symlinks: true

I have container'd containers with rotated logs by default. 5 log files 3 of them are \*.gz Files rotated by size exceeding 10 Mb. I have 30 harvesters and now i have 10000 d/s. Many containers write multiple logs per second

I observe data loss. Read offset is larger then file size.

I think I should use these parameters but I am confused which values should I set them to.

close\_inactive: 1m  
clean\_inactive: 10m  
ignore\_older: 5m

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [December 10, 2020, 7:20pm UTC](https://discuss.elastic.co/t/filebeat-kubernetes-data-loss/258322/2 "2020-12-10T19:20:15Z")

</div>

Hey @elastic_user1,

Could you explain more about the rotation of your logs? Are they being rotated with `copytruncate`?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 7, 2021, 9:20pm UTC](https://discuss.elastic.co/t/filebeat-kubernetes-data-loss/258322/3 "2021-01-07T21:20:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.