# Logstash Too many open files **URL:** \ **Category:** Logstash\ **Created:** [November 25, 2015, 5:25pm UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589 "2015-11-25T17:25:38Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Chris\_Clifton](https://avatars.discourse-cdn.com/v4/letter/c/82dd89/32.png) [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Post date:** [November 25, 2015, 5:25pm UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589/1 "2015-11-25T17:25:38Z")
Hi, running logstash 2.0.0-1 on Ubuntu 12.04.3 LTS , logstash running for about 24 hours then dying with 'Too many open files' paste -\> [http://pastebin.com/YsyKPUTL](http://pastebin.com/YsyKPUTL) ES is running on this same host, with two hosts sending logs to LS with log-courier. Very light load test setup, 2 local hosts sending apache and auth.log logs via log-courier to LS. Wondering why LS is opening so many files. ES ulimit is default in /etc/init.d/elasticsearch, MAX\_OPEN\_FILES=65535 LS ulimit is also default in /etc/init.d/logstash, LS\_OPEN\_FILES=16384 , is this the recommended amount? ES, LS config -\> [http://pastebin.com/PVykPiNJ](http://pastebin.com/PVykPiNJ) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 25, 2015, 6:58pm UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589/2 "2015-11-25T18:58:15Z")
Have you checked with lsof what files Logstash has opened? 16k file descriptors should be more than enough for you. ---
**Author:** ![Chris\_Clifton](https://avatars.discourse-cdn.com/v4/letter/c/82dd89/32.png) [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Post date:** [November 25, 2015, 10:49pm UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589/3 "2015-11-25T22:49:50Z")
pages and pages of these, (and growing) `java 26126 logstash 261u IPv4 197665 0t0 TCP ip-10-31-0-105.ec2.internal:52812->ip- 10-31-0-105.ec2.internal:9200 (ESTABLISHED) java 26126 logstash 262u IPv4 197678 0t0 TCP ip-10-31-0-105.ec2.internal:52821->ip-10-31-0-105.ec2.internal:9200 (ESTABLISHED) java 26126 logstash 263u IPv4 197681 0t0 TCP ip-10-31-0-105.ec2.internal:52822->ip-10-31-0-105.ec2.internal:9200 (ESTABLISHED) java 26126 logstash 264u IPv4 196008 0t0 TCP ip-10-31-0-105.ec2.internal:52831->ip-10-31-0-105.ec2.internal:9200 (ESTABLISHED)` ---
**Author:** ![Chris\_Clifton](https://avatars.discourse-cdn.com/v4/letter/c/82dd89/32.png) [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Post date:** [November 26, 2015, 4:26am UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589/4 "2015-11-26T04:26:10Z")
Hope this helps someone else, logstash output elasticsearch has sniffing enabled in many example configs ( [https://www.elastic.co/guide/en/beats/libbeat/current/getting-started.html#logstash-setup](https://www.elastic.co/guide/en/beats/libbeat/current/getting-started.html#logstash-setup) ) Be sure to check if sniffing is enabled ... \*\*this causes LS to open a new IPv4 socket every 5s by default \*\*... eventually exhausting open file limit in the OS (ubuntu 12 in my case) On default install of ES, LS, be sure to check the following parameters `sniffing sniffing_delay` Also in the course of debugging this, I discovered kibana also sends config requests every few seconds to ES, but doesn't seem to keep opening new connections like the ES output sniffing parameter problem I mention above. ``` `04:14:22.150092 IP 127.0.0.1.40938 > 127.0.0.1.9200: tcp 182 E....5@.@....... ......#..7}5.0.f ................ ....POST./.kiban a/config/_search .HTTP/1.1..Host: .localhost:9200. .Content-Length: .75..Connection: .keep-alive....{ "size":1000,"sor t":[{"buildNum": {"order":"desc", "ignore_unmapped ":true}}]} 04:14:22.151193 IP 127.0.0.1.9200 > 127.0.0.1.40938: tcp 357 E....b@.@.c..... ....#....0.f.7}. ................ ....HTTP/1.1.200 .OK..Content-Typ e:.application/j son;.charset=UTF -8..Content-Leng th:.270....{"too k":1,"timed_out" :false,"_shards" :{"total":1,"suc cessful":1,"fail ed":0},"hits":{" total":1,"max_sc ore":null,"hits" :[{"_index":".ki bana","_type":"c onfig","_id":"4. 3.0","_score":nu ll,"_source":{"b uildNum":9369,"d efaultIndex":"[f ilebeat-]YYYY.MM .DD"},"sort":["9 369"]}]}}` ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 26, 2015, 6:53am UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589/5 "2015-11-26T06:53:15Z")
You've hit this bug that was reported about a week ago: > ---
**Author:** ![Chris\_Clifton](https://avatars.discourse-cdn.com/v4/letter/c/82dd89/32.png) [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Post date:** [November 26, 2015, 2:40pm UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589/6 "2015-11-26T14:40:37Z")
> [@magnusbaeck](#): > > Issue: sniffing in logstash 2.0.0 results in file\_descriptor exhaustion Thanks, I'm using latest LS, ``` `root@Test:~# dpkg -l | grep logs ii logstash 1:2.1.0-1 An extensible logging pipeline root@Test:~# cat /etc/issue Ubuntu 12.04.3 LTS \n \l root@Test:~# uname -a Linux Test 3.2.0-57-virtual #87-Ubuntu SMP Tue Nov 12 21:53:49 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux ``` Someone should consider changing the documentation ( [Get started with Beats | Beats Platform Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/libbeat/current/getting-started.html#logstash-setup) ) or at least mention this in LS setup docs, at least until it's fixed. Causes even a small test setup to crash. ---
**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\ **Post date:** [November 26, 2015, 4:01pm UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589/7 "2015-11-26T16:01:42Z")
The fix for this is being tracked in [https://github.com/elastic/elasticsearch-ruby/issues/241](https://github.com/elastic/elasticsearch-ruby/issues/241) @Chris_Clifton we'll try to understand how quickly this can be solved, and if it warrants a warning in the meantime. from what we see it should be easy/quick to fix 🙂 ---
**Author:** ![iamthealex](https://avatars.discourse-cdn.com/v4/letter/i/e9c0ed/32.png) [@iamthealex](https://discuss.elastic.co/u/iamthealex)\ **Post date:** [July 5, 2016, 7:10pm UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589/8 "2016-07-05T19:10:46Z")
Is this fixed? In which version of LogStash is this fixed? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589/9 "2017-07-06T04:49:21Z")