title: Logstash close file descriptors?
body: <p><strong>BACKGROUND:</strong> </p>
  
  <p>We have <code>rsyslog</code> creating log files directories like: <code>/var/log/rsyslog/SERVER-NAME/LOG-DATE/LOG-FILE-NAME</code>
  So multiple servers are spilling out their logs of different dates to a central location.</p>
  
  <p>Now to read these logs and store them in elasticsearch for analysing I have my logstash config file something like this:</p>
  
  <pre><code>file{
     path =&gt; /var/log/rsyslog/**/*.log
  }
  </code></pre>
  
  <p><strong>ISSUE :</strong></p>
  
  <p>Now as number of log files in the directory increase, logstash opens file descriptors (FD) for new files and will not release FDs for already read log files. 
  Since log files are generated per date, once it is read, it is of no use after that since it will not be updated after that date.</p>
  
  <p>I have increased the file openings limit to 65K in <code>/etc/security/limits.conf</code> </p>
  
  <p>Can we make logstash close the handle after some time so that number of file handles opened do not increase too much ??</p>