# Filebeat 不释放文件句柄问题？求助 **URL:** \ **Category:** 中文提问与讨论\ **Created:** [May 16, 2017, 4:11pm UTC](https://discuss.elastic.co/t/filebeat/85982 "2017-05-16T16:11:31Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![can.zhang](https://avatars.discourse-cdn.com/v4/letter/c/9fc29f/32.png) [@can.zhang](https://discuss.elastic.co/u/can.zhang)\ **Post date:** [May 16, 2017, 4:11pm UTC](https://discuss.elastic.co/t/filebeat/85982/1 "2017-05-16T16:11:31Z")
## 我的环境是使用filebeat收集应用日志，上传到logstash-indexer，然后存入ES， filebeat版本是 1.3.1(amd64)，大概的配置是： paths: - /opt/mateinfo/logs/app/app.log input\_type: log fields: log\_format: wfm\_log4j fields\_under\_root: true ignore\_older: 1m close\_older: 30m document\_type: app\_log 因为发现日志盘空间变小，查了发现是filebeat没有释放日志文件句柄。我们是中间件是tomcat ,日志文件是50M，保存15个，业务量有时比较大，日志滚动很快。具体情况可以看下图，不知道有没有大神遇到过这种情况，是怎么解决的？ 大神们帮看看，非常感谢。 lsof |grep filebeat filebeat 32652 root 14r REG 202,32 52433403 262268 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 15r REG 202,32 52507192 262151 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 16r REG 202,32 52456387 262170 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 17r REG 202,32 52447751 262161 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 18r REG 202,32 52441595 262157 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 19r REG 202,32 52438227 262158 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 20r REG 202,32 52537002 262162 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 21r REG 202,32 52458855 262165 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 22r REG 202,32 52528456 262173 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 23r REG 202,32 52476072 262167 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 24r REG 202,32 52446487 262171 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 25r REG 202,32 52509690 262176 /opt/mateinfo/logs/app/app.log.15 filebeat 32652 root 26r REG 202,32 52469426 262169 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 27r REG 202,32 52488108 262172 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 28r REG 202,32 52451124 262174 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 29r REG 202,32 52444883 262156 /opt/mateinfo/logs/app/app.log.15 (deleted) filebeat 32652 root 30r REG 202,32 52613385 262160 /opt/mateinfo/logs/app/app.log.14 filebeat 32652 root 31r REG 202,32 52494350 262177 /opt/mateinfo/logs/app/app.log.13 filebeat 32652 root 32r REG 202,32 3065192 262178 /opt/mateinfo/logs/app/servicecreator.log filebeat 32652 root 33r REG 202,32 52571672 262168 /opt/mateinfo/logs/app/app.log.7 filebeat 32652 root 34r REG 202,32 52464099 262164 /opt/mateinfo/logs/app/app.log.11 filebeat 32652 root 35r REG 202,32 52556336 262180 /opt/mateinfo/logs/app/app.log.10 filebeat 32652 root 36r REG 202,32 52513605 262181 /opt/mateinfo/logs/app/app.log.8 filebeat 32652 root 37r REG 202,32 52503382 262185 /opt/mateinfo/logs/app/app.log.4 filebeat 32652 root 38r REG 202,32 52480734 262182 /opt/mateinfo/logs/app/app.log.6 filebeat 32652 root 39r REG 202,32 52467621 262184 /opt/mateinfo/logs/app/app.log.5 filebeat 32652 root 40r REG 202,32 52482734 262186 /opt/mateinfo/logs/app/app.log.3 filebeat 32652 root 41r REG 202,32 31626833 262189 /opt/mateinfo/logs/app/app.log filebeat 32652 root 42r REG 202,32 52453237 262188 /opt/mateinfo/logs/app/app.log.1 ll /opt/mateinfo/logs/app/app.log\* -rw-r--r-- 1 mateinfo inoc 39628681 May 16 15:34 /opt/mateinfo/logs/app/app.log -rw-r--r-- 1 mateinfo inoc 52453237 May 16 15:20 /opt/mateinfo/logs/app/app.log.1 -rw-r--r-- 1 mateinfo inoc 52556336 May 16 14:59 /opt/mateinfo/logs/app/app.log.10 -rw-r--r-- 1 mateinfo inoc 52464099 May 16 14:54 /opt/mateinfo/logs/app/app.log.11 -rw-r--r-- 1 mateinfo inoc 52584959 May 16 14:50 /opt/mateinfo/logs/app/app.log.12 -rw-r--r-- 1 mateinfo inoc 52494350 May 16 14:50 /opt/mateinfo/logs/app/app.log.13 -rw-r--r-- 1 mateinfo inoc 52613385 May 16 14:43 /opt/mateinfo/logs/app/app.log.14 -rw-r--r-- 1 mateinfo inoc 52509690 May 16 14:43 /opt/mateinfo/logs/app/app.log.15 -rw-r--r-- 1 mateinfo inoc 52550752 May 16 15:15 /opt/mateinfo/logs/app/app.log.2 -rw-r--r-- 1 mateinfo inoc 52482734 May 16 15:15 /opt/mateinfo/logs/app/app.log.3 -rw-r--r-- 1 mateinfo inoc 52503382 May 16 15:15 /opt/mateinfo/logs/app/app.log.4 -rw-r--r-- 1 mateinfo inoc 52467621 May 16 15:15 /opt/mateinfo/logs/app/app.log.5 -rw-r--r-- 1 mateinfo inoc 52480734 May 16 15:06 /opt/mateinfo/logs/app/app.log.6 -rw-r--r-- 1 mateinfo inoc 52571672 May 16 15:04 /opt/mateinfo/logs/app/app.log.7 -rw-r--r-- 1 mateinfo inoc 52513605 May 16 15:04 /opt/mateinfo/logs/app/app.log.8 -rw-r--r-- 1 mateinfo inoc 52529654 May 16 14:59 /opt/mateinfo/logs/app/app.log.9 ---
**Author:** ![can.zhang](https://avatars.discourse-cdn.com/v4/letter/c/9fc29f/32.png) [@can.zhang](https://discuss.elastic.co/u/can.zhang)\ **Post date:** [May 18, 2017, 8:22am UTC](https://discuss.elastic.co/t/filebeat/85982/2 "2017-05-18T08:22:18Z")
有人帮看看这个问题吗？有人遇到过吗？ ---
**Author:** ![medcl.net](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/medcl.net/32/4414_2.png) [@medcl.net](https://discuss.elastic.co/u/medcl.net)\ **Post date:** [May 29, 2017, 2:51pm UTC](https://discuss.elastic.co/t/filebeat/85982/3 "2017-05-29T14:51:29Z")
> [@can.zhang](#): > > close\_older: 30m 你把这个参数： close\_older: 30m 调整一下，如果你的滚动很快的话，30m可能比较大。 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 26, 2017, 2:51pm UTC](https://discuss.elastic.co/t/filebeat/85982/4 "2017-06-26T14:51:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.