# Data stream update information

**URL:** <https://discuss.elastic.co/t/data-stream-update-information/321770>\
**Category:** Kibana\
**Created:** [December 21, 2022, 1:31pm UTC](https://discuss.elastic.co/t/data-stream-update-information/321770 "2022-12-21T13:31:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Svetlo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/svetlo/32/99497_2.png) [@Svetlo](https://discuss.elastic.co/u/Svetlo)\
**Post date:** [December 21, 2022, 1:31pm UTC](https://discuss.elastic.co/t/data-stream-update-information/321770/1 "2022-12-21T13:31:18Z")

</div>

Hello,

I am trying to troubleshoot disappearing logs. Logs that are associated with a particular data stream have disappeared (I am not able to find under the data stream) outside of office hours. As they have disappeared in the middle of the night, no changes from our side have been done to elastic. The only clue I have is that the data stream have been updated in the time logs disappeared. Health of data stream is green.

How I can see more information for this updated (I can see _Last updated_ date in the **data Streams** bot nothing more)? If not I was thinking of rollover the stream but not sure if this is going to make any difference.

Thank you.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 21, 2022, 2:01pm UTC](https://discuss.elastic.co/t/data-stream-update-information/321770/2 "2022-12-21T14:01:28Z")

</div>

Elasticsearch does not delete anything unless it is told to by a `DELETE` request or using an ILM policy.

Also, you can't updated documents in the backing indices of a data streams.

Does your data stream have any ILM policy attached?

Is your cluster exposed to the public internet? Does it have security enabled?

What do you have in the logs for the master node? Any delete request will be shown in the logs of the current master node.

---

<div class="post-metadata">

**Author:** ![Svetlo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/svetlo/32/99497_2.png) [@Svetlo](https://discuss.elastic.co/u/Svetlo)\
**Post date:** [December 21, 2022, 2:06pm UTC](https://discuss.elastic.co/t/data-stream-update-information/321770/3 "2022-12-21T14:06:58Z")

</div>

Thank you for the answer.

Sorry, probably my explanation was misleading (as I am new to elastic). By disappearing I meant - no new logs have appeared under this data stream (I have checked logs are sent). Old logs can still be seen under Analytics/Discover.  
Yes, there is a ILM policy but it haven't been touched when the logs stopped appearing.

Is there a way to see what have been updated into the data stream?

---

<div class="post-metadata">

**Author:** ![Svetlo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/svetlo/32/99497_2.png) [@Svetlo](https://discuss.elastic.co/u/Svetlo)\
**Post date:** [December 22, 2022, 10:18am UTC](https://discuss.elastic.co/t/data-stream-update-information/321770/4 "2022-12-22T10:18:29Z")

</div>

It seems that rollover fixed the problem. I am still curious what actually have happened and will really like to see some explanation hot to tshoot such problems in the future.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 19, 2023, 10:18am UTC](https://discuss.elastic.co/t/data-stream-update-information/321770/5 "2023-01-19T10:18:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.