Log file size vs. quantity

While troubleshooting high cpu usage by Filebeat (80% sustained, even when logs are idle), I noticed it showed a large number of files (current: 8811) in the registrar:


That was surprising, since these files were quite old and never updated. I did see the open_files was only 4, and that seemed correct to me. To test, I purged all the old files from disk, leaving only the last few days worth, and Filebeat CPU quickly dropped back to 1-5%. I now see this in the logs (current:1392):


What does current represent here? Since these files were not being updated I would expect them to be removed from the registry, but they seem to be consuming resources.

To keep this number lower, is it advisable to have a small number of large files (rolling daily / weekly) rather than a large number of small files (rolling minutely / hourly)?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.