Logstash open_file handle issue For Linux

If you have 5000 files discoverable files and you set max_open_files => 65535 then close_older is irrelevant for the purposes of managing the "sliding window" because all the files fit in the window (it does not slide) but it can be relevant to a lower value of file handles open at the OS level.

You might want to script periodic sampling of lsof on Logstash while setting close_older to "20s", "10s", "5s" and "2s" to see whether/when the files opened by Logstash goes below 5000.

1 Like