inf2ravikumar

Hi not sure it bug but filebeat is killing space on filesystem once I restart filebeat system get back to normal 
can some one please tell why filebeat stuck to old files I'm running 5.5.2 version ?
root@hostname]# ps -ef | grep filebeat
root     30340 27644  0 20:15 pts/1    00:00:00 grep filebeat
root     31773     1  0 Sep07 ?        00:00:00 /usr/share/filebeat/bin/filebeat-god -r / -n -p /var/run/filebeat.pid -- /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
root     31774 31773  0 Sep07 ?        00:27:46 /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
[root@ccdn-ats-tk-21482-02 ~]# lsof -p 31774
COMMAND    PID USER   FD   TYPE    DEVICE   SIZE/OFF    NODE NAME
filebeat 31774 root  cwd    DIR       8,3       4096       2 /
filebeat 31774 root  rt

inf2ravikumar

[root@elk-es-ho-11 network-scripts]# curl -XGET 10.146.134.12:8888/_cat/nodes?v
ip            heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
10.146.134.10           73          94  26    1.90    2.10     3.00 di        -      elk-es-ho-09.
10.146.134.14            3          36   0    0.00    0.01     0.05 mi        -      elk-es-ho-13.
10.146.134.24           75          95  22    7.50    4.12     3.51 di        -      elk-es-ho-04.
10.146.134.7            40          91  26    6.44    8.50     8.66 di        -      elk-es-ho-06.
10.146.134.13            3          37   0    0.02    0.02     0.05 mi        -      elk-es-ho-12.
10.146.134.6            67          94  23    1.67    2.48     3.71 di        -      elk-es-ho-05.
10.146.134.11            3          36   0    0.00    0.01     0.05 i         -      elk-es-ho-10.
10.146.134.8            37          91  23    7.92    5.87     5.82 di        -      elk-es-ho-07.

inf2ravikumar

[root@elk-es-ho-11 network-scripts]# curl -XGET 10.146.134.12:8888/_cat/indices?v
health status index                                   uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   logstash-custom_ats_2-vector-2017.06.23 aahC5d3FQkmn8kTMJkP8ag  12   1    5228354            0     15.3gb          7.6gb
green  open   logstash-error-vector-2017.06.30        HUqDNYxkTBqlxdpVqK2qpg  12   1   97937269            0     43.8gb         21.8gb
green  open   logstash-drive-vector-2017.06.27        8SCykFNsSgGRkfktjtRxaA  12   1      12065            0     11.2mb          5.5mb
green  open   logstash-secure-vector-2017.06.30       SxV5IQN2RRq4DTWqTREeqA  12   1     101980            0     92.6mb         46.3mb
green  open   logstash-teakd-vector-2017.07.03        Vj1KUNkhSFu--xtItRlf5w  12   1   54535883            0    107.4gb         53.6gb
green  open   .triggered_watches                      VNzJLlT7TZCvr4UDIHn2cg   1   1          0            0    136.5kb         68.2