Too many open files?

Elastic Stack Logstash
1

I am seeing errors in myLF log file around too many open files and observe that no events are subsequently forwarded after this error.

I am processing files that are effectively closed - if I set the "dead time" variable to something small like 1h, am I correct in assuming the LF will release the file descriptor for a file after 1 hour ?

2

"dead time" closes open file handles after they are idle for the specified time period. So in your case, files should be closed if nothing has been written to them for an hour.