# Filebeat with high memory consumption after logrotate
**URL:** https://discuss.elastic.co/t/filebeat-with-high-memory-consumption-after-logrotate/243497
**Category:** Beats
**Tags:** filebeat
**Created:** [August 3, 2020, 4:50am UTC](https://discuss.elastic.co/t/filebeat-with-high-memory-consumption-after-logrotate/243497 "2020-08-03T04:50:44Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@mohanisch](https://discuss.elastic.co/u/mohanisch)
#### Post date: [August 3, 2020, 4:50am UTC](https://discuss.elastic.co/t/filebeat-with-high-memory-consumption-after-logrotate/243497/1 "2020-08-03T04:50:45Z")
Hello!
We use Filebeat (in Docker, version 7.8) to send logs to Logstash. Every night at 0:01 logrotate runs on the machine where Filebeat is running. It is rotating ~20-25 logfiles. Logrotate is configured with following options:
```auto
daily
missingok
rotate 7
compress
copytruncate
dateext
dateformat .%Y-%m-%d-%s.rotlog
```
From the moment logrotate starts, Filebeat starts allocating a lot of memory.
Filebeat is reporting, that the file got truncated, sure, that is true.
We've already tried out:
- mem limit configured to container - this ends up in a restart loop of that container
- configured `queue.spool` instead of `queue.mem`
- configured `close_inactive` to 30min (in the night logs are used less)
- configured `client_inactivity_timeout` in Logstash (in the night logs are used less)
- split the log rotation into time frames (cron is starting different jobs between 0:01 and 0:10)
All these attempts have not helped to throttle the memory consumption of Filebeat. After the first rotation, the consumption is very high.
So what's the problem here?
Cheers
Marco
---
### Author:  [@mohanisch](https://discuss.elastic.co/u/mohanisch)
#### Post date: [August 4, 2020, 2:45am UTC](https://discuss.elastic.co/t/filebeat-with-high-memory-consumption-after-logrotate/243497/2 "2020-08-04T02:45:39Z")
This is an Scrrenshot from this night. What is happening there? Why is Filebeat collecting \> 5GB of RAM?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 4, 2020, 3:08am UTC](https://discuss.elastic.co/t/filebeat-with-high-memory-consumption-after-logrotate/243497/3 "2020-08-04T03:08:32Z")
Welcome to our community! 😃
Which part of the memory is that actually measuring?
---
### Author:  [@mohanisch](https://discuss.elastic.co/u/mohanisch)
#### Post date: [August 4, 2020, 3:22am UTC](https://discuss.elastic.co/t/filebeat-with-high-memory-consumption-after-logrotate/243497/4 "2020-08-04T03:22:38Z")
Hey Mark,
this is the container memory usage. I
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 4, 2020, 3:35am UTC](https://discuss.elastic.co/t/filebeat-with-high-memory-consumption-after-logrotate/243497/5 "2020-08-04T03:35:17Z")
I will take an educated guess and suggest that this is virtual memory being used by Filebeat juggling the files that it wants to read and has read.
Hopefully someone will pop in and ask a few more specific questions, as I can't really comment on how to reduce it.
---
### Author:  [@mohanisch](https://discuss.elastic.co/u/mohanisch)
#### Post date: [August 4, 2020, 3:47am UTC](https://discuss.elastic.co/t/filebeat-with-high-memory-consumption-after-logrotate/243497/6 "2020-08-04T03:47:53Z")
I'm just a bit surprised that Filebeat needs up to 6GB of memory after the truncate. It is only a spike, but it would be good to get a grip on this behaviour. I would like to understand what happens internally and also understand why Filebeat uses \< 500MB during the day but after the rotation an undefined amount.
I'm currently a bit at a loss as to how we can get a handle on this. This setup is currently not in production, only on a test environment. On production, logs are available around the clock.
---
### Author:  [@mohanisch](https://discuss.elastic.co/u/mohanisch)
#### Post date: [August 20, 2020, 7:56am UTC](https://discuss.elastic.co/t/filebeat-with-high-memory-consumption-after-logrotate/243497/7 "2020-08-20T07:56:12Z")
Anyone? No ideas?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 17, 2020, 9:56am UTC](https://discuss.elastic.co/t/filebeat-with-high-memory-consumption-after-logrotate/243497/8 "2020-09-17T09:56:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.