# Elastic can not see the lastest log after using ILM

**URL:** <https://discuss.elastic.co/t/elastic-can-not-see-the-lastest-log-after-using-ilm/330822>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [April 26, 2023, 10:52am UTC](https://discuss.elastic.co/t/elastic-can-not-see-the-lastest-log-after-using-ilm/330822 "2023-04-26T10:52:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [April 26, 2023, 10:52am UTC](https://discuss.elastic.co/t/elastic-can-not-see-the-lastest-log-after-using-ilm/330822/1 "2023-04-26T10:52:32Z")

</div>

My es version is 7.13.4,but after i change the ilm policy, i can not receive any new log from the logstash, even i set the ilm\_enable=false

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [April 26, 2023, 11:03am UTC](https://discuss.elastic.co/t/elastic-can-not-see-the-lastest-log-after-using-ilm/330822/2 "2023-04-26T11:03:11Z")

</div>

the configuration is as below  
if [fields][tags] == "prd-k8s-app" {  
if "\_dateparsefailure" not in [tags] and "\_grokparsefailure" not in [tags] and "_timestampfailure" not in [tags] {  
elasticsearch {  
hosts =\> ["[https://x.x.x.x:9200](https://x.x.x.x:9200)"]  
index =\> "%{[k8s.container]}_%{+YYYY.MM.dd}"  
action=\>"create"  
ilm\_enable=\>false  
user =\> logstash  
password =\> "xxxx"  
ssl =\> true  
ssl\_certificate\_verification =\> true  
cacert =\> "/etc/logstash/ssl/ca.pem"

```
  }
} else {
  file {
    path => "/var/log/logstash/error/%{[tags]}_error-%{+YYYY.MM.dd}.log"
    codec => rubydebug
  }
}

```

}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 2, 2023, 3:16am UTC](https://discuss.elastic.co/t/elastic-can-not-see-the-lastest-log-after-using-ilm/330822/3 "2023-05-02T03:16:54Z")

</div>

What do the Logstash logs show? What does the policy look like?

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [May 2, 2023, 9:52am UTC](https://discuss.elastic.co/t/elastic-can-not-see-the-lastest-log-after-using-ilm/330822/4 "2023-05-02T09:52:22Z")

</div>

It is OK now.we used the lfm feature and it use steaming instead of indices.but for the streaming the default configuration is hidden.That is why we can not see the logs.

Mark Walkom via Discuss the Elastic Stack \<[notifications@elastic.discoursemail.com](mailto:notifications@elastic.discoursemail.com)\>于2023年5月2日 周二11:26写道：

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2023, 9:52am UTC](https://discuss.elastic.co/t/elastic-can-not-see-the-lastest-log-after-using-ilm/330822/5 "2023-05-30T09:52:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.