OK i thought the open file Limit was the problem but it was not.
Right now i have about 300 logfiles sources that are indexed, so far it it ran for about 8-9 days. this morning filebeat again started to read and send all logs in over and over again like filebeat lost tracking of the files it already read in.
I also noticed that filebeat keeps rotating its registry log.json and xxxxxxx.json
under /var/lib/filebeat/registry/filebeat/
when the filesize of log.json exceed 10MB.
I have to index logfile from 400+ Cisco devices that are rotated daily and thats for sure is a problem right now.