This post is older than a year. Consider some information might not be accurate anymore.
An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or UNIX domain socket.) A specific file or all the files in a file system may be selected by path.
Linux man page
The command lsof allows you to display all open files used by a process. Following example uses a logstash process. It has no input files, but usually if you want to know which log files logstash or the logstash forwarder is using, you can display them with lsof. Check which pid logstash has
tan@cinhtau:/opt/logstash$ ps -Af | grep [l]ogstash
logstash 2551 1 86 14:18 pts/1 00:00:21 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.io.tmpdir=/var/lib/logstash -Xmx500m -Xss2048k -Djffi.boot.library.path=/opt/logstash/vendor/jruby/lib/jni -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.io.tmpdir=/var/lib/logstash -Xbootclasspath/a:/opt/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/opt/logstash/vendor/jruby -Djruby.lib=/opt/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /opt/logstash/lib/bootstrap/environment.rb logstash/runner.rb agent -f /etc/logstash/conf.d -l /var/log/logstash/logstash.log
Display open files
tan@cinhtau:/opt/logstash$ sudo lsof -nPp 2551
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 2551 logstash cwd DIR 8,1 4096 1704261 /var/lib/logstash
java 2551 logstash rtd DIR 8,1 4096 2 /
java 2551 logstash txt REG 8,1 7526 931275 /usr/lib/jvm/zulu-8-amd64/jre/bin/java
java 2551 logstash mem REG 8,1 48909 931327 /usr/lib/jvm/zulu-8-amd64/jre/lib/amd64/libmanagement.so
java 2551 logstash mem REG 8,1 1281 1191239 /opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.5/lib/JRubyFileExtension.jar
# output truncated a bunch of java libs
java 2551 logstash 46u 0000 0,9 0 8530 anon_inode
java 2551 logstash 47r FIFO 0,8 0t0 23158 pipe
# output truncated a bunch of pipes
java 2551 logstash 98u IPv6 23166 0t0 TCP *:9300 (LISTEN)
java 2551 logstash 99u unix 0xffff8801f1b20000 0t0 23167 socket
java 2551 logstash 100u IPv6 25071 0t0 TCP 10.0.2.15:54667->10.0.2.15:9300 (ESTABLISHED)
# output truncated a bunch of used sockets
java 2551 logstash 129u IPv6 23259 0t0 TCP 127.0.0.1:9300->127.0.0.1:41905 (ESTABLISHED)
