ELK - Filebeat重启之后不读Log了？Registry file is too large

Filebeat重启之后突然不读Log了，看起来又是正常运行。

问一下有没有什么Bug，说Registry file is too large。

后来我看了一下，只有几十M，不大呀？

回复说，几十M已经太大了。

果然，对大的理解不太一样。

看一下文档，大概明白大的意思了，因为这其实是状态文件，Filebeat每时每刻都要读写。

Filebeat keeps the state of each file and persists the state to disk in the registry file. The file state is used to continue file reading at a previous position when Filebeat is restarted. If a large number of new files are produced every day, the registry file might grow to be too large. To reduce the size of the registry file, there are two configuration options available: clean_removed and clean_inactive.

For old files that you no longer touch and are ignored (see ignore_older), we recommended that you use clean_inactive. If old files get removed from disk, then use the clean_removed option.

所以解决办法就是：清理过期文件记录，增加写缓存时间减少IO。

vi /etc/filebeat/filebeat.yml

ignore_older: 24h 
clean_inactive: 25h

filebeat.registry.flush: 5s