Too many open file handlers

Filebeat keeps the file handler open in case it reaches the end of a file so that it can read new log lines in near real time. If Filebeat is harvesting a large number of files, the number of open files can become an issue. In most environments, the number of files that are actively updated is low. The close_inactive configuration option should be set accordingly to close files that are no longer active.

There are additional configuration options that you can use to close file handlers, but all of them should be used carefully because they can have side effects. The options are:

The close_renamed and close_removed options can be useful on Windows to resolve issues related to file rotation. See Open file handlers cause issues with Windows file rotation. The close_eof option can be useful in environments with a large number of files that have only very few entries. The close_timeout option is useful in environments where closing file handlers is more important than sending all log lines. For more details, see Configure inputs.

Make sure that you read the documentation for these configuration options before using any of them.