# Delay in logs in filebeat for only one index

**URL:** <https://discuss.elastic.co/t/delay-in-logs-in-filebeat-for-only-one-index/329282>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 4, 2023, 7:13am UTC](https://discuss.elastic.co/t/delay-in-logs-in-filebeat-for-only-one-index/329282 "2023-04-04T07:13:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ks-ak](https://avatars.discourse-cdn.com/v4/letter/k/53a042/32.png) [@ks-ak](https://discuss.elastic.co/u/ks-ak)\
**Post date:** [April 4, 2023, 7:13am UTC](https://discuss.elastic.co/t/delay-in-logs-in-filebeat-for-only-one-index/329282/1 "2023-04-04T07:13:54Z")

</div>

Hi!  
I have filebeat with multiple indexes and one particular index is causing the issue and other indexes are sending logs without delayi.e., Sending logs to Kibana is getting delayed by 6 hours for the particular index.

```auto
`filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /mnt/test*.log
  json.message_key: msg
  json.keys_under_root: true
  json.ignore_decoding_error: true
  document_type: api
  fields:
    type: test-api
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /mnt/test1*.log
  json.message_key: msg
  json.keys_under_root: true
  json.ignore_decoding_error: true
  document_type: api
  fields:
    type: test1-api
output.elasticsearch:
  bulk_max_size: 7000
  workers: 10
  protocol: "https"
  template.name: filebeat
  template.path: filebeat.template.json
  index: "ecs-%{[fields.type]:other}-{+yyyy.MM.dd}"
setup.template.name: filebeat
setup.template.pattern: "filebeat-*"
setup.ilm.enabled: false
setup.ilm.check_exists: false
setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 1
  index.refresh_interval: "30s"
`

test1-api is generating large sized logs whereas test-api is relatively smaller. any suggestions to resolve the issue
```

---

<div class="post-metadata">

**Author:** ![ks-ak](https://avatars.discourse-cdn.com/v4/letter/k/53a042/32.png) [@ks-ak](https://discuss.elastic.co/u/ks-ak)\
**Post date:** [April 4, 2023, 7:24am UTC](https://discuss.elastic.co/t/delay-in-logs-in-filebeat-for-only-one-index/329282/3 "2023-04-04T07:24:08Z")

</div>

test1-api is generating large sized logs whereas test-api is relatively smaller. any suggestions to resolve the issue

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 2, 2023, 9:24am UTC](https://discuss.elastic.co/t/delay-in-logs-in-filebeat-for-only-one-index/329282/4 "2023-05-02T09:24:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.