# Filebeat log.json file

**URL:** https://discuss.elastic.co/t/filebeat-log-json-file/272528
**Category:** Beats
**Tags:** filebeat
**Created:** [May 10, 2021, 3:14am UTC](https://discuss.elastic.co/t/filebeat-log-json-file/272528 "2021-05-10T03:14:59Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![shifenglim](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@shifenglim](https://discuss.elastic.co/u/shifenglim)
#### Post date: [May 10, 2021, 3:14am UTC](https://discuss.elastic.co/t/filebeat-log-json-file/272528/1 "2021-05-10T03:14:59Z")

</div>

My application team tried an experiment for filebeat,

They deleted the log file that filebeat was harvesting and each time the log file is deleted, in the directory, a file in the path /data/registry/filebeat/log.json keeps growing in size

Would this be a concern if this log.json keeps growing? How does this log.json work?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 10, 2021, 3:36am UTC](https://discuss.elastic.co/t/filebeat-log-json-file/272528/2 "2021-05-10T03:36:53Z")

</div>

Have a read of [How Filebeat works | Filebeat Reference [7.12] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html#_how_does_filebeat_keep_the_state_of_files) and let us know if you have further questions about the registry.

---

<div class="post-metadata">

### Author: ![shifenglim](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@shifenglim](https://discuss.elastic.co/u/shifenglim)
#### Post date: [May 10, 2021, 4:48am UTC](https://discuss.elastic.co/t/filebeat-log-json-file/272528/3 "2021-05-10T04:48:55Z")

</div>

this registry/filebeat/log.json is the registry file mentioned in the post? We came across this post but wasn't sure if this is the file it was mentioning

---

<div class="post-metadata">

### Author: ![shifenglim](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@shifenglim](https://discuss.elastic.co/u/shifenglim)
#### Post date: [May 10, 2021, 6:44am UTC](https://discuss.elastic.co/t/filebeat-log-json-file/272528/4 "2021-05-10T06:44:32Z")

</div>

Hi, we tried the clean\_removed: true option which it was already supposed to be default to true and it doesnt clear the log.json file, we opened up the log.json and saw old logs dated back to 30/4

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 10, 2021, 6:44am UTC](https://discuss.elastic.co/t/filebeat-log-json-file/272528/5 "2021-05-10T06:44:57Z")

</div>

Is it causing an issue?

What version are you using?

---

<div class="post-metadata">

### Author: ![shifenglim](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@shifenglim](https://discuss.elastic.co/u/shifenglim)
#### Post date: [May 10, 2021, 6:49am UTC](https://discuss.elastic.co/t/filebeat-log-json-file/272528/6 "2021-05-10T06:49:08Z")

</div>

hi yes, we are afraid to go into production as we are unsure if this file will keep growing and are not able to clear this file properly, we are using filebeat 7.8.1

---

<div class="post-metadata">

### Author: ![shifenglim](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@shifenglim](https://discuss.elastic.co/u/shifenglim)
#### Post date: [May 11, 2021, 2:41am UTC](https://discuss.elastic.co/t/filebeat-log-json-file/272528/7 "2021-05-11T02:41:22Z")

</div>

to be exact

filebeat is logging a file:  
applicationlog.log

and everyday, we will rename the log to:  
applicationlog-dd-mm-yyyy.log

and the application will then recreate the file:  
applicationlog.log

We monitor the log.json file which increases everyday which could cause out of space issues, hence keeping us from going live.

We tried methods such as clean\_removed etc which doesn't clear the log.json file

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 8, 2021, 4:41am UTC](https://discuss.elastic.co/t/filebeat-log-json-file/272528/8 "2021-06-08T04:41:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
