# Date freeze in index after rollover (only in windows) logstah 7.9.2

**URL:** <https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300>\
**Category:** Logstash\
**Created:** [September 29, 2020, 6:48am UTC](https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300 "2020-09-29T06:48:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![benji\_c](https://avatars.discourse-cdn.com/v4/letter/b/848f3c/32.png) [@benji\_c](https://discuss.elastic.co/u/benji_c)\
**Post date:** [September 29, 2020, 6:48am UTC](https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300/1 "2020-09-29T06:48:45Z")

</div>

Hi!

After a few hours reviewing configurations and creating and deleting index and creating ILM noticed an issue with the logstash 7.9.2 windows version, that freezes date fields in new index when doing rollover.  
Let me put you into context, we have a logstash 7.9.2 on a windows server, to read application logs and to feed a al index into an elastic (7.9.1) index with some date fields. This Index has a ILM and in Kibana a few timeseries Dashboards using the date in the index as reference.  
At start everything is fine and visualize correctly the data in the dashboards, but as soon as the index is rolledover and starts reading from the new one, the date fields in the index freeze (checked the fisical log and date is fine) and in consequence dashboards fail in visualization.  
This has been "fixed" by changing logstash version to 6.1.  
Also this not happen when the logstash (7.9.2) is on a linux server

Not sure if this is the channel to report this issue, if this is so, please let me know how to report it

Index mapping: (partial)

```auto
{
  "gi-inbo-connection-manager-000054" : {
    "aliases" : {
      "gi-inbo-connection-manager-alias" : {
        "is_write_index" : false
      }
    },
    "mappings" : {
		....
        "rqTimestamp" : {
          "type" : "date",
          "format" : "epoch_millis"
        },
        "rqTimestampTrace" : {
          "type" : "date",
          "format" : "yyyy-MM-dd HH:mm:ss"
        },

```

Logstash config:

```
input {
        file {
           path => "C:/XX/XX/XX/XX/logKibana.log"
           start_position => beginning
		   sincedb_path => "NUL"
        }
      }

filter {
      json {
        source => "message"
      }
    }

output {
        stdout { codec => rubydebug}
           elasticsearch {
             hosts => ["XXXX.XXX.XX.XX:9200"]
              index => "gi-inbo-connection-manager-alias"
           }
}

```

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 29, 2020, 2:27pm UTC](https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300/2 "2020-09-29T14:27:35Z")

</div>

> [@benji\_c](#):
>
> the date fields in the index freeze

What do you mean by this?

---

<div class="post-metadata">

**Author:** ![benji\_c](https://avatars.discourse-cdn.com/v4/letter/b/848f3c/32.png) [@benji\_c](https://discuss.elastic.co/u/benji_c)\
**Post date:** [September 29, 2020, 2:46pm UTC](https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300/3 "2020-09-29T14:46:04Z")

</div>

Say that whe have an index with `rqTimestamp` that logs an incoming request timestamp field in index **gi-inbo-connection-manager-000001**. When it's rolled over to **gi-inbo-connection-manager-000002** the `rqTimestamp` freezes in the last timestamp recorded in **gi-inbo-connection-manager-000001** , for all new documents. It does not show the real timestamp that is in the log (double check the phisical log for the date to be OK).  
Stangerlly this only happens when logstash 7.9.2 version is running on windows server. Lower version workes fine or on linux works fine also

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 29, 2020, 5:36pm UTC](https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300/4 "2020-09-29T17:36:17Z")

</div>

I cannot imagine what could be causing that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2020, 5:36pm UTC](https://discuss.elastic.co/t/date-freeze-in-index-after-rollover-only-in-windows-logstah-7-9-2/250300/5 "2020-10-27T17:36:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.