Elasticsearch data indexing for logstash

Elastic Stack Elasticsearch
6

With respect to above query below is some more information/issues.

  1. As per Marvel
    logstash-2015.11.19 data size is 1,004.8MB and Document Count is 2.4m
    logstash-2015.11.20 data size is 263.7MB and Document count is 618.5k

  2. But I am not able to view any data related to logstash-2015.11.20 in Kibana.

  3. Later investigated the log files and got to know last update to elasticsearch index happened on 2015-11-19 22:04:09,842 and last good contact between logstash and elasticsearch is at ~Thu Nov 19 23:00:00 CST 2015.

  4. So while creating new indices folder by elasticsearch, logstash is loosing connectivity with elasticsearch. I have observed the same behaviour on 2015.11.17 but restarting logstash instance resolved the problem but triggered my initial query on this topic.

My ELK stack setup flow

Server1 -> Server2 -> Server3
Server1 -> Logstash forwarder
Server2 -> Logstash lumberjack input plugin -> Logstash Kafka output plugin
Server3 -> Logstash kafka input plugin -> grok filter plugin -> Logstash elasticsearch output plugin.

This is the POC i am working and planning to implement production setup in next week. Any suggestions will be great help.