Filebeat locks application logs on Windows

Filebeat does not lock the log files that it reads from. On Windows, Filebeat requests only generic read access to the file. It uses the share mode bit mask of FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE which can allow other applications to read/write/delete the file.

It's most likely that the application is requesting exclusive rights to the file (an empty share mode bit mask). If this is the case, Windows will prevent the application from opening the file when another application has any handle open to the file (event just for reading). Windows gives a ERROR_SHARING_VIOLATION in this case.

To determine the share mode bits used by your application, start the application, and then use the Sysinternals handle.exe tool to see what share mode bits are set for the log file handle. For an example see this post: File open mode

Reference: CreateFile function