I'm using filebeat to ship logs created by log4cxx to ELK stack.
When filebeat is running but logstash is not available, log4cxx cannot rotate log file, so it becomes large (log generation speed is about 4 MB per minute, we use log rotation by 1 MB).
I tried to set close_timeout option to 1m, but filebeat still keeps the file open.
Please see the log file generated by filebeat:
So how to make filebeat not block the file rotation?