We had an issue where logstash opened over 5000 threads. As a consequence, the OS didn't let other processes start on the machine and we had to kill the logstash process.
I'm guessing that logstash had one thread open per file. Most of the files are old and aren't getting updated, and since we are "tail'ing" them I'm guessing it makes no sense to have a thread watch over them.
Is there something we can do to optimize logstash to work with less threads?