Filebeat locking Files older than IGNORE_OLDER value

Elastic Stack Beats
1

Hi,

We have filebeat version 1.1.2 installed on windows servers.
Monitoring Logs from Weblogic applications.

The IGNORE_OLDER value for the prospectors is 2h
But, however it seems that Filebeat is locking even older files like 4 days ago, and even more.
So these older files cannot be deleted.

Is there any known bug regarding that issue ?

Thanks,

Ori

2

Ignore_older had a few issues prior filebeat 1.2 that is why close_older was introduced. But the above should not happen in 1.1.2. Can you try 1.2 to see if the problem persists? Can you share your config?

3

Hi Ruflin,

Thanks A lot!!!!
I am currently examining Version 1.2.2 of Filebeat.
After some tests on my desktop it seems to work as expected, now checking it on Dev Servers.

There is also a stability issue with 1.1.2 - It keeps crashing on our Windows Machines.
Could not find any reason why????? (Log with debug level).

Ori