# Recommended settings with close\_removed and clean\_removed false

**URL:** <https://discuss.elastic.co/t/recommended-settings-with-close-removed-and-clean-removed-false/327226>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [March 7, 2023, 8:11pm UTC](https://discuss.elastic.co/t/recommended-settings-with-close-removed-and-clean-removed-false/327226 "2023-03-07T20:11:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![running\_banana](https://avatars.discourse-cdn.com/v4/letter/r/ecd19e/32.png) [@running\_banana](https://discuss.elastic.co/u/running_banana)\
**Post date:** [March 7, 2023, 8:11pm UTC](https://discuss.elastic.co/t/recommended-settings-with-close-removed-and-clean-removed-false/327226/1 "2023-03-07T20:11:58Z")

</div>

Hi,

We were looking to tune our `filebeat.autodiscover` settings to better handle scraping of ephemeral docker containers. The main issue we have is that when the container is stopped and removed, its log file also gets removed. Filebeat closes the harvester and does not finish scraping the remainder of the file as a result.

We've been told that setting `close_removed: false` should help with the above situation, which should keep the harvester open even if the corresponding logfile is deleted/removed.

In the filebeat documentation, it also states that if `close_removed` is set to `false`, then `clean_removed: false` should also be set.

We were wondering then, does the state for these harvesters/files _ever_ get removed afterwards at any point? Will the `clean_inactive` (or some other `clean_*`) setting help with removing the state once the harvester finishes reading the logfile?

What are some other settings we should set/change so that the filebeat registry does not grow unbounded?

Let me know if there is anything else I should clarify on. Thank you in advance!

---

<div class="post-metadata">

**Author:** ![running\_banana](https://avatars.discourse-cdn.com/v4/letter/r/ecd19e/32.png) [@running\_banana](https://discuss.elastic.co/u/running_banana)\
**Post date:** [March 31, 2023, 5:26am UTC](https://discuss.elastic.co/t/recommended-settings-with-close-removed-and-clean-removed-false/327226/2 "2023-03-31T05:26:23Z")

</div>

hi are there any recommendations for this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2023, 7:27am UTC](https://discuss.elastic.co/t/recommended-settings-with-close-removed-and-clean-removed-false/327226/3 "2023-04-28T07:27:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
