# Feed lost data to ELK

**URL:** <https://discuss.elastic.co/t/feed-lost-data-to-elk/198997>\
**Category:** Elasticsearch\
**Created:** [September 11, 2019, 3:55am UTC](https://discuss.elastic.co/t/feed-lost-data-to-elk/198997 "2019-09-11T03:55:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rajith\_konara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajith_konara/32/50115_2.png) [@Rajith\_konara](https://discuss.elastic.co/u/Rajith_konara)\
**Post date:** [September 11, 2019, 3:55am UTC](https://discuss.elastic.co/t/feed-lost-data-to-elk/198997/1 "2019-09-11T03:55:24Z")

</div>

Hi all,

I' am having an production incident, we loss 12 hours of data due to some incident, now the service is back to normal and elastic is serving the data, but we need to fill the loss data gap. We have the relevant log files. How can we feed these missing data ?  
Here is an screenshot of the kibana.  
Appreciate your valuable inputs on this 🙂.

![gap](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e0aab5fe083ba9af4b5e1590053e3cf1a18c286d.png)

Thank you,  
Rajith

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [September 13, 2019, 2:27pm UTC](https://discuss.elastic.co/t/feed-lost-data-to-elk/198997/2 "2019-09-13T14:27:19Z")

</div>

I suspect this is more of a question for the logstash forum, it being upstream of elasticsearch.

---

<div class="post-metadata">

**Author:** ![Rajith\_konara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajith_konara/32/50115_2.png) [@Rajith\_konara](https://discuss.elastic.co/u/Rajith_konara)\
**Post date:** [September 16, 2019, 3:44am UTC](https://discuss.elastic.co/t/feed-lost-data-to-elk/198997/3 "2019-09-16T03:44:10Z")

</div>

Created the topic in the logstash forum.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2019, 3:44am UTC](https://discuss.elastic.co/t/feed-lost-data-to-elk/198997/4 "2019-10-14T03:44:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.