# Will filebeat lock files?
**URL:** https://discuss.elastic.co/t/will-filebeat-lock-files/52190
**Category:** Beats
**Created:** [June 8, 2016, 9:59am UTC](https://discuss.elastic.co/t/will-filebeat-lock-files/52190 "2016-06-08T09:59:03Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@zpp](https://discuss.elastic.co/u/zpp)
#### Post date: [June 8, 2016, 9:59am UTC](https://discuss.elastic.co/t/will-filebeat-lock-files/52190/1 "2016-06-08T09:59:03Z")
Hi, I met a situation where it seemed that filebeat locked the application logs.
The application generates log file like appx.log, after some time or certain size is hit, it will rename the existing appx.log to appx\_back.log, and start a new appx.log for logging. when it's time to rename the new appx.log again, it will just rename it and overwrite the existing appx\_back.log.
With below filebeat settings, it is observed that application is not able to rename appx.log to appx\_back.log, util appx.log reached a few GB, resulting in application crash. Does filebeat actually lock the log files it looks after? for this case, how to resolve it? thank you.
filebeat:
prospectors:
paths:
- //var/log/appx/\*.log
input\_type: log
```
ignore_older: 10m
document_type: appx
tail_files: true
```
registry\_file: "C:/ProgramData/filebeat/registry"
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [June 8, 2016, 3:16pm UTC](https://discuss.elastic.co/t/will-filebeat-lock-files/52190/2 "2016-06-08T15:16:06Z")
Filebeat keeps the file handler open until it reaches ignore\_older (or close\_older in the newer versions). But that should not prevent you from renaming the file, only from deleting it.
Which version of filebeat are you using? Which OS?
---
### Author:  [@zpp](https://discuss.elastic.co/u/zpp)
#### Post date: [June 9, 2016, 3:48am UTC](https://discuss.elastic.co/t/will-filebeat-lock-files/52190/3 "2016-06-09T03:48:23Z")
I'm using filebeat version 1.1.1 (386), on a window 2012 box.
_\> But that should not prevent you from renaming the file, only from deleting it._
if the appx\_back.log already exists, the next rename from appx.log to appx\_back.log involves an overwrite of the exsiting appx\_back.log, not sure this is considered as delete?
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [June 9, 2016, 10:53am UTC](https://discuss.elastic.co/t/will-filebeat-lock-files/52190/4 "2016-06-09T10:53:14Z")
I think that counts as a delete as the file will disappear afterwards.
---
### Author:  [@zpp](https://discuss.elastic.co/u/zpp)
#### Post date: [June 9, 2016, 11:51am UTC](https://discuss.elastic.co/t/will-filebeat-lock-files/52190/5 "2016-06-09T11:51:50Z")
But that doesn't mean filebeat will lock the file forever right?
the application checks whether appx.log needs to be renamed periodically, it can't be every time it checks, the file is locked by filebeat. Is there a way we can further troubleshoot this issue and solve it?
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [June 10, 2016, 6:41am UTC](https://discuss.elastic.co/t/will-filebeat-lock-files/52190/6 "2016-06-10T06:41:41Z")
Filebeat should release the file handle after ignore\_older? Can you update the version to 1.2.3? There is also close\_older which can be set to a much lower value and ignore\_older is not needed.
If you enable the debug output with `-e -d "*"` you should see when filebeat closes a file (or not).
---
### Author:  [@zpp](https://discuss.elastic.co/u/zpp)
#### Post date: [June 10, 2016, 7:59am UTC](https://discuss.elastic.co/t/will-filebeat-lock-files/52190/7 "2016-06-10T07:59:51Z")
Ok, I'll try it out
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2016, 9:59am UTC](https://discuss.elastic.co/t/will-filebeat-lock-files/52190/8 "2016-06-29T09:59:20Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.