We have a cronjob to reduce log size in case disk full. the command used is truncate. like:
truncate -s 15G /path/to/file
We found that filebeat will quickly eat up all memory in the system (16GB in our case) when log file got truncated. Restart filebeat wouldn't help (filebeat process RSS memory would reach 15GB in a few seconds), unless removed the registry file to make filebeat read log file from the beginning again.
Not sure if this is a bug, or is there any configure to suppress this issue