Logstash open file descriptors only increases

[N1k-3l]

Hello.
I have a problem with logstash (logstash 7.12.1)

file descriptors only increases. I set limits to 50000, but on another host, with the same config i have:

may be somebody knows about this?

[N1k-3l]

Solution:
File desriptors opened by attempts to start listen 514 port (syslog), however logstash user haven't had permissions to this operation, so descriptors couldn't become closed.
After remove syslog from my input to logstash problem has gone.

[Badger]

That feels very much like a bug. Running

input { syslog {} }
output { stdout { codec => rubydebug { metadata => false } } }

with a non-priviliged user results in lsof showing an ever increasing number of open files. The errors that are logged are

[2021-10-15T13:52:46,426][WARN ][logstash.inputs.syslog   ][main][d2aa53ecc994ad31a69c9075a3104af82d3db4575af93e207a9b4c77fce875a2] syslog listener died {:protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:129:in `initialize'", "org/jruby/RubyIO.java:876:in `new'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:208:in `tcp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:172:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:156:in `block in run'"]}
[2021-10-15T13:52:46,473][INFO ][logstash.inputs.syslog   ][main][d2aa53ecc994ad31a69c9075a3104af82d3db4575af93e207a9b4c77fce875a2] Starting syslog udp listener {:address=>"0.0.0.0:514"}
[2021-10-15T13:52:46,473][WARN ][logstash.inputs.syslog   ][main][d2aa53ecc994ad31a69c9075a3104af82d3db4575af93e207a9b4c77fce875a2] syslog listener died {:protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2) for "0.0.0.0" port 514>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:210:in `bind'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:191:in `udp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:172:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:152:in `block in run'"]}

The code has ensure blocks that close the tcp/udp sockets, but it seems not to work as intended.