# Logstash max\_open\_files setting not working?

**URL:** <https://discuss.elastic.co/t/logstash-max-open-files-setting-not-working/143208>\
**Category:** Logstash\
**Created:** [August 6, 2018, 7:16pm UTC](https://discuss.elastic.co/t/logstash-max-open-files-setting-not-working/143208 "2018-08-06T19:16:19Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jspriesterbach](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@jspriesterbach](https://discuss.elastic.co/u/jspriesterbach)\
**Post date:** [August 6, 2018, 7:16pm UTC](https://discuss.elastic.co/t/logstash-max-open-files-setting-not-working/143208/1 "2018-08-06T19:16:19Z")

</div>

Hello,

I am using logstash version 6.3 and I can't seem to get the max\_open\_files to stick. According to the proc it is set properly:

root@ip-172-31-47-78:/proc/1433# cat limits | grep "Max open files"  
Max open files 16384 16384 files

But in the logs I am still getting:

[2018-08-06T19:12:48,088][WARN][logstash.inputs.file] Reached open files limit: 4095, set by the 'max\_open\_files' option or default, files yet to open: 14325

in /etc/logstash/startup.options LS\_OPEN\_FILES is set to 16384:

startup.options:LS\_OPEN\_FILES=16384

I also tried setting it in /etc/default/logstash

/etc/logstash# cat /etc/default/logstash |grep OPEN  
LS\_OPEN\_FILES="16384"  
MAX\_OPEN\_FILES="16384"

Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 6, 2018, 8:57pm UTC](https://discuss.elastic.co/t/logstash-max-open-files-setting-not-working/143208/2 "2018-08-06T20:57:06Z")

</div>

You need to set it on the file input itself

```
input {
    file {
        path => ...
        max_open_files => 16384
        ...
```

---

<div class="post-metadata">

**Author:** ![jspriesterbach](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@jspriesterbach](https://discuss.elastic.co/u/jspriesterbach)\
**Post date:** [August 6, 2018, 9:41pm UTC](https://discuss.elastic.co/t/logstash-max-open-files-setting-not-working/143208/3 "2018-08-06T21:41:15Z")

</div>

That does not appear to work either. I have set this and its still throwing the 4096 limit error:

/home/ubuntu# cat /etc/logstash/conf.d/rds\_slow\_logs.conf  
input {  
file {  
max\_open\_files =\> 20000  
path =\> "/mnt/baks/rds\_slowquery\_logs/\*"  
type =\> "rds\_slow\_query"  
start\_position =\> "beginning"  
}  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 6, 2018, 10:17pm UTC](https://discuss.elastic.co/t/logstash-max-open-files-setting-not-working/143208/4 "2018-08-06T22:17:55Z")

</div>

Does setting the environment variable FILEWATCH\_MAX\_OPEN\_FILES work?

---

<div class="post-metadata">

**Author:** ![jspriesterbach](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@jspriesterbach](https://discuss.elastic.co/u/jspriesterbach)\
**Post date:** [August 6, 2018, 11:04pm UTC](https://discuss.elastic.co/t/logstash-max-open-files-setting-not-working/143208/5 "2018-08-06T23:04:32Z")

</div>

I set it in /etc/logstash/startup.options but does not appear to do anything either. I am using a debian based system (aws ec2, stretch/sid)

---

<div class="post-metadata">

**Author:** ![tetra1](https://avatars.discourse-cdn.com/v4/letter/t/97f17d/32.png) [@tetra1](https://discuss.elastic.co/u/tetra1)\
**Post date:** [August 31, 2018, 2:45pm UTC](https://discuss.elastic.co/t/logstash-max-open-files-setting-not-working/143208/6 "2018-08-31T14:45:37Z")

</div>

hello. can logstash insert txt file into elasticsearch?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 28, 2018, 2:45pm UTC](https://discuss.elastic.co/t/logstash-max-open-files-setting-not-working/143208/7 "2018-09-28T14:45:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.