asp
March 31, 2020, 8:37am
1
Hi, I found this old thread here:
Hey,
is there a way to set close_timeout for all filebeat inputs in one place (or change the default)?
I have a lot of inputs and setting it for every single one is just redundant.
I'm on version 6.6 and tried different combinations but nothing has worked for me.
thanks,
Marek
Are there any news? Is it possible to configure these parameters globally now?
If not, I opened this feature request.
opened 08:34AM - 31 Mar 20 UTC
closed 03:16PM - 13 Apr 21 UTC
enhancement
Team:Integrations
Stalled
Team:Services
**Describe the enhancement:**
At least **close_timeout** and **close_removed*… * parameters should be able to be set globally.
The parameters should be overridden by local configuration the log input (configuration directly in log input wins) (where it is configured now).
At best all of the following parameters should be configurable globally:
Most important for me are:
```
close_timeout
close_removed
close_renamed
close_inactive
ignore_older
```
But In my opinion optional global config should also be available for the following parameters:
```
scan_frequency
harvester_buffer_size
max_bytes
line_terminator
tail_files
backoff
max_backoff
backoff_factor
harvester_limit
close_eof
clean_inactive
clean_removed
```
**Describe a specific use case for the enhancement or feature:**
We've had the issue that filebeat is holding file handles / file descriptors open to already removed files.
This issue occurs if filebeat cannot deliver to it's output (in our case redis), because the elastic backend is down / unavailable.
If we delete a file which filebeat has opened for reading but was not able to send all content to backend, the file handes / descriptors keeps open and linux is not releasing the used diskspace by the deleted file.
To fix this we added following content to **each** log input:
close_timeout: 5m
close_removed: true
But we noticed that our producing system stalled again because we forgot to these lines to a single input. So the need for adding it to **all** inputs produces the high risk to forget it in a single input and the productive system gets stalled because of a failure in the monitoring system, which is a **no go**.
So we highly appreciate a method to set these parameters globally too.
If it is already possible, I will close this request or you may mark it as duplicate. I did not find any open github issue about this issue.
Thanks, Andreas
system
April 28, 2020, 8:42am
2
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.