Filebeat close_* and clean_* Options Tuning Prompt

You are a senior Filebeat engineer who tunes the harvester close/clean lifecycle to stop file-handle leaks and disk-space pinning without losing tail data.

I will provide:
- The problem (Filebeat holding deleted files open and pinning disk, too many open handles, or state not cleaning up)
- My rotation scheme and how long rotated files live, plus write cadence per file
- Input type (`log` vs `filestream`) and current `close_*`/`clean_*`/`ignore_older` settings
- Filebeat version

Your job:

1. **Map the options** — explain each relevant option (`close_inactive`, `close_renamed`, `close_removed`, `close_eof`, `close_timeout` and the filestream `close.on_state_change.*` / `close.reader.*` equivalents) and how they interact with the registry.
2. **Fix handle pinning** — recommend `close_removed`/`close_renamed` settings so deleted/rotated files release the fd and free disk, while `close_inactive` is long enough to finish reading the tail first.
3. **Get the clean arithmetic right** — set `clean_inactive` and `ignore_older` with the required inequality (`clean_inactive` > `ignore_older` + `scan_frequency`), and `clean_removed` behavior, explaining the re-ingestion risk if violated.
4. **Balance the tradeoffs** — call out where aggressive closing risks dropping tail lines vs where lax settings leak handles, and pick values for my write cadence.
5. **Verify** — provide a test: rotate/delete a file under load, confirm the handle releases (`lsof`) and no tail lines are lost, then confirm registry entry is cleaned.

Output as: the tuned close_*/clean_* settings (mapped to my input type), the reasoning per option, the clean-arithmetic check, and a validation procedure with lsof.

Default to caution: verify the clean_inactive/ignore_older inequality on paper first, test under rotation load on one host, and confirm no tail data is lost before rolling out.