# High disk usage while docker container is recreating

**URL:** <https://discuss.elastic.co/t/high-disk-usage-while-docker-container-is-recreating/264533>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 17, 2021, 8:30am UTC](https://discuss.elastic.co/t/high-disk-usage-while-docker-container-is-recreating/264533 "2021-02-17T08:30:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![homa\_inc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/homa_inc/32/83979_2.png) [@homa\_inc](https://discuss.elastic.co/u/homa_inc)\
**Post date:** [February 17, 2021, 8:30am UTC](https://discuss.elastic.co/t/high-disk-usage-while-docker-container-is-recreating/264533/1 "2021-02-17T08:30:32Z")

</div>

Hi there.  
I have Filebeat container that configured to scan redis logs from redis container. There is configuration (filebeat.yml):

```auto
filebeat.registry.flush: 2s

output.elasticsearch:
  hosts: ['${ELASTICSEARCH_HOSTS:elasticsearch:9200}']
  username: '${ELASTICSEARCH_USERNAME:}'
  password: '${ELASTICSEARCH_PASSWORD:}'

filebeat.modules:
  - module: redis
    slowlog:
        enabled: false

setup.kibana:
    host: '${KIBANA_HOST:kibana:5601}'
    username: '${KIBANA_USER:}'
    password: '${KIBANA_PASSWORD:}'

setup.dashboards.enabled: true

filebeat.autodiscover:
    providers:
      - type: docker
        templates:
          - condition:
                contains:
                    docker.container.image: redis
            config:
              - module: redis
                log:
                    input:
                        type: container
                        close_inactive: 1m
                        scan_frequency: 10s
                        paths:
                          - /var/lib/docker/containers/${data.docker.container.id}/*.log

```

After I've started the containers and then I've tried to recreate redis container, I got 100% disk usage. How can I fix that?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [February 17, 2021, 7:29pm UTC](https://discuss.elastic.co/t/high-disk-usage-while-docker-container-is-recreating/264533/2 "2021-02-17T19:29:09Z")

</div>

Hey @homa_inc, welcome to discusss 🙂

What host is getting 100% disk usage? The one running Filebeat, or the one running Elasticsearch?

If it is the one running Filebeat, could you check with `lsof` if Filebeat is keeping many files open?

Filebeat keeps files open while it reads them, this can prevent files to be completely removed from disk if they are removed or rotated. This is the expected default behaviour to avoid losing logs that are rotated too quickly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 17, 2021, 9:29pm UTC](https://discuss.elastic.co/t/high-disk-usage-while-docker-container-is-recreating/264533/3 "2021-03-17T21:29:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.