# Log file size vs. quantity

**URL:** <https://discuss.elastic.co/t/log-file-size-vs-quantity/168090>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 12, 2019, 5:32pm UTC](https://discuss.elastic.co/t/log-file-size-vs-quantity/168090 "2019-02-12T17:32:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nskerl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nskerl/32/40847_2.png) [@nskerl](https://discuss.elastic.co/u/nskerl)\
**Post date:** [February 12, 2019, 5:32pm UTC](https://discuss.elastic.co/t/log-file-size-vs-quantity/168090/1 "2019-02-12T17:32:31Z")

</div>

While troubleshooting high cpu usage by Filebeat (80% sustained, even when logs are idle), I noticed it showed a large number of files ( **current: 8811** ) in the registrar:

`"harvester":{"open_files":4,"running":4}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":214,"batches":4,"total":214},"read":{"bytes":24},"write":{"bytes":16075}},"pipeline":{"clients":1,"events":{"active":0,"published":214,"total":214},"queue":{"acked":214}}},"registrar":{"states":{"current":8811,"update":214},"writes":4}}}}`

That was surprising, since these files were quite old and never updated. I did see the `open_files` was only 4, and that seemed correct to me. To test, I purged all the old files from disk, leaving only the last few days worth, and Filebeat CPU quickly dropped back to 1-5%. I now see this in the logs ( **current:1392** ):

`"harvester":{"open_files":4,"running":4}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":804,"batches":4,"total":804},"read":{"bytes":24},"write":{"bytes":62509}},"pipeline":{"clients":1,"events":{"active":0,"published":625,"total":625},"queue":{"acked":804}}},"registrar":{"states":{"current":1392,"update":804},"writes":4}}}}`

What does `current` represent here? Since these files were not being updated I would expect them to be removed from the registry, but they seem to be consuming resources.

To keep this number lower, is it advisable to have a small number of large files (rolling daily / weekly) rather than a large number of small files (rolling minutely / hourly)?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 12, 2019, 5:41pm UTC](https://discuss.elastic.co/t/log-file-size-vs-quantity/168090/2 "2019-03-12T17:41:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.