Is there any indication that logstash forwarder finished processing a file?

Question

I would like to delete files after logstash forwarder sent them (otherwise I get too many files open error). Is there any indication that logstash forwarder is done with the file?

Answer 1

logstash-forwarder keeps a "registry" file called .logstash-forwarder that contains information about the file (really inode) and byte offset into that file.

You can compare that information with the actual file itself to see if LSF is finished.

I do the same to tell is LSF is falling behind in its processing.