Filebeat 不释放文件句柄问题？求助

Elastic In Your Native Tongue 中文提问与讨论
1

我的环境是使用filebeat收集应用日志，上传到logstash-indexer，然后存入ES， filebeat版本是 1.3.1(amd64)，大概的配置是：

paths:

  • /opt/mateinfo/logs/app/app.log
    input_type: log
    fields:
    log_format: wfm_log4j
    fields_under_root: true
    ignore_older: 1m
    close_older: 30m
    document_type: app_log

因为发现日志盘空间变小，查了发现是filebeat没有释放日志文件句柄。我们是中间件是tomcat ,日志文件是50M，保存15个，业务量有时比较大，日志滚动很快。具体情况可以看下图，不知道有没有大神遇到过这种情况，是怎么解决的？
大神们帮看看，非常感谢。

lsof |grep filebeat

filebeat 32652 root 14r REG 202,32 52433403 262268 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 15r REG 202,32 52507192 262151 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 16r REG 202,32 52456387 262170 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 17r REG 202,32 52447751 262161 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 18r REG 202,32 52441595 262157 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 19r REG 202,32 52438227 262158 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 20r REG 202,32 52537002 262162 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 21r REG 202,32 52458855 262165 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 22r REG 202,32 52528456 262173 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 23r REG 202,32 52476072 262167 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 24r REG 202,32 52446487 262171 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 25r REG 202,32 52509690 262176 /opt/mateinfo/logs/app/app.log.15
filebeat 32652 root 26r REG 202,32 52469426 262169 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 27r REG 202,32 52488108 262172 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 28r REG 202,32 52451124 262174 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 29r REG 202,32 52444883 262156 /opt/mateinfo/logs/app/app.log.15 (deleted)
filebeat 32652 root 30r REG 202,32 52613385 262160 /opt/mateinfo/logs/app/app.log.14
filebeat 32652 root 31r REG 202,32 52494350 262177 /opt/mateinfo/logs/app/app.log.13
filebeat 32652 root 32r REG 202,32 3065192 262178 /opt/mateinfo/logs/app/servicecreator.log
filebeat 32652 root 33r REG 202,32 52571672 262168 /opt/mateinfo/logs/app/app.log.7
filebeat 32652 root 34r REG 202,32 52464099 262164 /opt/mateinfo/logs/app/app.log.11
filebeat 32652 root 35r REG 202,32 52556336 262180 /opt/mateinfo/logs/app/app.log.10
filebeat 32652 root 36r REG 202,32 52513605 262181 /opt/mateinfo/logs/app/app.log.8
filebeat 32652 root 37r REG 202,32 52503382 262185 /opt/mateinfo/logs/app/app.log.4
filebeat 32652 root 38r REG 202,32 52480734 262182 /opt/mateinfo/logs/app/app.log.6
filebeat 32652 root 39r REG 202,32 52467621 262184 /opt/mateinfo/logs/app/app.log.5
filebeat 32652 root 40r REG 202,32 52482734 262186 /opt/mateinfo/logs/app/app.log.3
filebeat 32652 root 41r REG 202,32 31626833 262189 /opt/mateinfo/logs/app/app.log
filebeat 32652 root 42r REG 202,32 52453237 262188 /opt/mateinfo/logs/app/app.log.1

ll /opt/mateinfo/logs/app/app.log*
-rw-r--r-- 1 mateinfo inoc 39628681 May 16 15:34 /opt/mateinfo/logs/app/app.log
-rw-r--r-- 1 mateinfo inoc 52453237 May 16 15:20 /opt/mateinfo/logs/app/app.log.1
-rw-r--r-- 1 mateinfo inoc 52556336 May 16 14:59 /opt/mateinfo/logs/app/app.log.10
-rw-r--r-- 1 mateinfo inoc 52464099 May 16 14:54 /opt/mateinfo/logs/app/app.log.11
-rw-r--r-- 1 mateinfo inoc 52584959 May 16 14:50 /opt/mateinfo/logs/app/app.log.12
-rw-r--r-- 1 mateinfo inoc 52494350 May 16 14:50 /opt/mateinfo/logs/app/app.log.13
-rw-r--r-- 1 mateinfo inoc 52613385 May 16 14:43 /opt/mateinfo/logs/app/app.log.14
-rw-r--r-- 1 mateinfo inoc 52509690 May 16 14:43 /opt/mateinfo/logs/app/app.log.15
-rw-r--r-- 1 mateinfo inoc 52550752 May 16 15:15 /opt/mateinfo/logs/app/app.log.2
-rw-r--r-- 1 mateinfo inoc 52482734 May 16 15:15 /opt/mateinfo/logs/app/app.log.3
-rw-r--r-- 1 mateinfo inoc 52503382 May 16 15:15 /opt/mateinfo/logs/app/app.log.4
-rw-r--r-- 1 mateinfo inoc 52467621 May 16 15:15 /opt/mateinfo/logs/app/app.log.5
-rw-r--r-- 1 mateinfo inoc 52480734 May 16 15:06 /opt/mateinfo/logs/app/app.log.6
-rw-r--r-- 1 mateinfo inoc 52571672 May 16 15:04 /opt/mateinfo/logs/app/app.log.7
-rw-r--r-- 1 mateinfo inoc 52513605 May 16 15:04 /opt/mateinfo/logs/app/app.log.8
-rw-r--r-- 1 mateinfo inoc 52529654 May 16 14:59 /opt/mateinfo/logs/app/app.log.9

2

有人帮看看这个问题吗？有人遇到过吗？

3

你把这个参数：
close_older: 30m
调整一下，如果你的滚动很快的话，30m可能比较大。

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.