# Logstash and open files question

**URL:** <https://discuss.elastic.co/t/logstash-and-open-files-question/123115>\
**Category:** Logstash\
**Created:** [March 8, 2018, 3:57pm UTC](https://discuss.elastic.co/t/logstash-and-open-files-question/123115 "2018-03-08T15:57:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\
**Post date:** [March 8, 2018, 3:57pm UTC](https://discuss.elastic.co/t/logstash-and-open-files-question/123115/1 "2018-03-08T15:57:35Z")

</div>

Hi all,  
I have a question regarding how Logstash, when reading directly from files.  
Here is my input pluging conf:

```
input {
    file {
        path => "/data/sbc/elkdev/*"
        start_position => "beginning"
        discover_interval => 300
        ignore_older => 1800
    }
}

```

As far I understand Logstash will ignore files whose modification date is 30 min older... Only files that are new or have been modified in the last 30 minutes will be taken into account.  
In addition, will check the files every 5 minutes. Is my interpretation correct?

In my scenario I have two or three new files every 30 min (those files once copied are not further modified). So, if my interpretation is correct Logstash will have only 2 or 3 logs files opened at the same time.

But If I inspect the list of open files (using the lsof command) I see that Logstash maintains older files than the ones in the last 30 min.  
What I'm doing/interpreting wrong?  
Thank you!  
Regards  
Ana

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 8, 2018, 4:14pm UTC](https://discuss.elastic.co/t/logstash-and-open-files-question/123115/2 "2018-03-08T16:14:51Z")

</div>

> [@Anabella\_Cristaldi](#):
>
> What I'm doing/interpreting wrong?

The close\_older option?

---

<div class="post-metadata">

**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\
**Post date:** [March 8, 2018, 4:42pm UTC](https://discuss.elastic.co/t/logstash-and-open-files-question/123115/3 "2018-03-08T16:42:14Z")

</div>

Thank you @Badger!  
I put the close\_older to 1800 and now I only have 3 files opened for the logstash pid

```
anna@elk01:/data/sbc/elkdev/scripts # lsof -p 20462 | grep FRAUD
java 20462 logstash 61r REG 253,5 453678 27132653 /data/sbc/elkdev/FRAUD_SBC_INT_201803081630_000038535
java 20462 logstash 62r REG 253,5 484880 27132654 /data/sbc/elkdev/FRAUD_SBC_INT_201803081645_000038536
java 20462 logstash 65r REG 253,5 464944 27132646 /data/sbc/elkdev/FRAUD_SBC_INT_201803081700_000038537

```

But for each file open I have 55 threads... Is that the normal Logstash behaviour?  
Using lsof -p LS\_PID

```
anna@elk01:/data/sbc/elkdev/scripts # lsof -p 20462 | grep FRAUD | wc -l
3

```

Using lsof -K -p LS\_PID

```
anna@elk01:/data/sbc/elkdev/scripts # lsof -K -p 20462 | grep FRAUD | wc -l
165

```

Thank you!  
Anna

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2018, 4:42pm UTC](https://discuss.elastic.co/t/logstash-and-open-files-question/123115/4 "2018-04-05T16:42:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.