# Holding onto handles of deleted files

**URL:** https://discuss.elastic.co/t/holding-onto-handles-of-deleted-files/72340
**Category:** Beats
**Created:** [January 20, 2017, 8:57pm UTC](https://discuss.elastic.co/t/holding-onto-handles-of-deleted-files/72340 "2017-01-20T20:57:56Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![justinyeh3112](https://avatars.discourse-cdn.com/v4/letter/j/85f322/32.png) [@justinyeh3112](https://discuss.elastic.co/u/justinyeh3112)
#### Post date: [January 20, 2017, 8:57pm UTC](https://discuss.elastic.co/t/holding-onto-handles-of-deleted-files/72340/1 "2017-01-20T20:57:56Z")

</div>

Hi,  
Is there a good way to have filebeat let go of the filehandle for a file after a certain amount of inactivity to the file?

We are running into the following problem:

1. Filebeat is tracking FileA
2. The output target goes down, so Filebeat is unable to ship any additional log lines for FileA
3. FileA is deleted (rotated, disk cleanup, etc)
4. Since Filebeat still holds onto the filehandle, the OS never reclaims that disk space.

We have a few systems that produce a large number of temporary logs with very verbose log lines and when the above happens, over time, disk space can get filled up. In this scenario, if we have to choose between disk space filling and the service failing, or, failing to ship some log lines, we'd rather choose the latter.

It seems to me that close\_inactive should kick in after the default of 5m and allow the file to be closed, but that doesn't seem to be working. We've also tried setting close\_timeout with no luck.

---

<div class="post-metadata">

### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [January 23, 2017, 12:11pm UTC](https://discuss.elastic.co/t/holding-onto-handles-of-deleted-files/72340/2 "2017-01-23T12:11:51Z")

</div>

Having the output blocked, means also all of the close\_\* options ([https://www.elastic.co/guide/en/beats/filebeat/5.1/configuration-filebeat-options.html#close-options](https://www.elastic.co/guide/en/beats/filebeat/5.1/configuration-filebeat-options.html#close-options)) will not apply as the harvesters are completely blocked. But we are definitively thinking about solutions to this: [https://github.com/elastic/beats/pull/3091](https://github.com/elastic/beats/pull/3091) But we stoped some initial approaches as we want to have a solid solution here.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 10, 2017, 8:58pm UTC](https://discuss.elastic.co/t/holding-onto-handles-of-deleted-files/72340/3 "2017-02-10T20:58:36Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.
