# Logstash 6.5.0-1 throwing OPEN\_WARN\_INTERVAL warning

**URL:** <https://discuss.elastic.co/t/logstash-6-5-0-1-throwing-open-warn-interval-warning/160275>\
**Category:** Logstash\
**Created:** [December 11, 2018, 2:49am UTC](https://discuss.elastic.co/t/logstash-6-5-0-1-throwing-open-warn-interval-warning/160275 "2018-12-11T02:49:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raj\_S](https://avatars.discourse-cdn.com/v4/letter/r/8e8cbc/32.png) [@Raj\_S](https://discuss.elastic.co/u/Raj_S)\
**Post date:** [December 11, 2018, 2:49am UTC](https://discuss.elastic.co/t/logstash-6-5-0-1-throwing-open-warn-interval-warning/160275/1 "2018-12-11T02:49:51Z")

</div>

Hi,  
Currently I'm seeing some servers are shows this following wARN in logstash 6.5.0-1

`Preformatted text`[WARN][filewatch.tailmode.handlers.createinitial] open\_file OPEN\_WARN\_INTERVAL is '300'`Preformatted text`

Would be great if anyone knows how to fix this.

Thanks in advance...

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [December 11, 2018, 12:51pm UTC](https://discuss.elastic.co/t/logstash-6-5-0-1-throwing-open-warn-interval-warning/160275/2 "2018-12-11T12:51:31Z")

</div>

You must be tailing more than 4095 files.

You need to set close\_older to a shorter time to give files 4096+ a chance to be opened and read.

Are you really tailing or trying to read static files?

---

<div class="post-metadata">

**Author:** ![Raj\_S](https://avatars.discourse-cdn.com/v4/letter/r/8e8cbc/32.png) [@Raj\_S](https://discuss.elastic.co/u/Raj_S)\
**Post date:** [December 11, 2018, 7:39pm UTC](https://discuss.elastic.co/t/logstash-6-5-0-1-throwing-open-warn-interval-warning/160275/3 "2018-12-11T19:39:49Z")

</div>

Thanks for prompt response.

We use

file {  
path =\> ['/var/log/app/api.log']  
}

How does it opens up those other files? Where do I need to specify that `close_older` value?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2019, 7:39pm UTC](https://discuss.elastic.co/t/logstash-6-5-0-1-throwing-open-warn-interval-warning/160275/4 "2019-01-08T19:39:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.