List open files of a dedicated process

An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or UNIX domain socket.) A specific file or all the files in a file system may be selected by path.

Linux man page

The command lsof allows you to display all open files used by a process. Following example uses a logstash process. It has no input files, but usually if you want to know which log files logstash or the logstash forwarder is using, you can display them with lsof. Check which pid logstash has

tan@cinhtau:/opt/logstash$ ps -Af | grep [l]ogstash
logstash  2551     1 86 14:18 pts/1    00:00:21 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.io.tmpdir=/var/lib/logstash -Xmx500m -Xss2048k -Djffi.boot.library.path=/opt/logstash/vendor/jruby/lib/jni -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.io.tmpdir=/var/lib/logstash -Xbootclasspath/a:/opt/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/opt/logstash/vendor/jruby -Djruby.lib=/opt/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /opt/logstash/lib/bootstrap/environment.rb logstash/runner.rb agent -f /etc/logstash/conf.d -l /var/log/logstash/logstash.log

Display open files

tan@cinhtau:/opt/logstash$ sudo lsof -nPp 2551
java    2551 logstash  cwd    DIR                8,1     4096 1704261 /var/lib/logstash
java    2551 logstash  rtd    DIR                8,1     4096       2 /
java    2551 logstash  txt    REG                8,1     7526  931275 /usr/lib/jvm/zulu-8-amd64/jre/bin/java
java    2551 logstash  mem    REG                8,1    48909  931327 /usr/lib/jvm/zulu-8-amd64/jre/lib/amd64/libmanagement.so
java    2551 logstash  mem    REG                8,1     1281 1191239 /opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.5/lib/JRubyFileExtension.jar
# output truncated a bunch of java libs
java    2551 logstash   46u  0000                0,9        0    8530 anon_inode
java    2551 logstash   47r  FIFO                0,8      0t0   23158 pipe
# output truncated a bunch of pipes
java    2551 logstash   98u  IPv6              23166      0t0     TCP *:9300 (LISTEN)
java    2551 logstash   99u  unix 0xffff8801f1b20000      0t0   23167 socket
java    2551 logstash  100u  IPv6              25071      0t0     TCP> (ESTABLISHED)
# output truncated a bunch of used sockets
java    2551 logstash  129u  IPv6              23259      0t0     TCP> (ESTABLISHED)