# Important delay in the appearance of logs in Kibana **URL:** \ **Category:** Logstash\ **Created:** [March 3, 2017, 3:34pm UTC](https://discuss.elastic.co/t/important-delay-in-the-appearance-of-logs-in-kibana/77330 "2017-03-03T15:34:18Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![vdsm](https://avatars.discourse-cdn.com/v4/letter/v/46a35a/32.png) [@vdsm](https://discuss.elastic.co/u/vdsm)\ **Post date:** [March 3, 2017, 3:34pm UTC](https://discuss.elastic.co/t/important-delay-in-the-appearance-of-logs-in-kibana/77330/1 "2017-03-03T15:34:18Z")
Hi everyone, I see a problem about my ELK stack currently in pre-production, and I do not understand where it comes from ... When I view the logs in Kibana, these are systematically between 25 and 40 minutes behind the T time. for exemple, when I am watching logs in Kibana at 16H, I seen logs happend 30 minutes ago. I had no time lag during my tries that had not a lot of logs, unlike my server that stores a lot of logs More (+/- 2 million per week) which makes me think that there is a bottleneck somewhere, especially since my VM on which my ELK runs is slightly undersized relative to the volume of data to be processed. Nevertheless, I have big doubts about Logstash because I can get logs in live on Kibana when I restart the Logstash service. However, the offset is recreated little by little up to 40 minutes max, and the most constraining is that all these logs that I did not see in live In Kibana are lost when restarting the LS service! I saw that there were "queue" solutions like Redis, would the setting up of such a server between LS and elasticsearch could resolve my problem ? Knowing that the goal is to have live logs in Kibana ... Is someone see what can be my problem ? Thanks. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 5, 2017, 9:47pm UTC](https://discuss.elastic.co/t/important-delay-in-the-appearance-of-logs-in-kibana/77330/2 "2017-03-05T21:47:26Z")
How are logs being sent to Logstash? ---
**Author:** ![vdsm](https://avatars.discourse-cdn.com/v4/letter/v/46a35a/32.png) [@vdsm](https://discuss.elastic.co/u/vdsm)\ **Post date:** [March 5, 2017, 10:08pm UTC](https://discuss.elastic.co/t/important-delay-in-the-appearance-of-logs-in-kibana/77330/3 "2017-03-05T22:08:02Z")
Logs are sent from à rsyslog server with udp protocol ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 5, 2017, 11:41pm UTC](https://discuss.elastic.co/t/important-delay-in-the-appearance-of-logs-in-kibana/77330/4 "2017-03-05T23:41:11Z")
Given it's UDP it's either a timezone difference, or a delay in rsyslog. LS won't hold onto things for 30 minutes like this. ---
**Author:** ![vdsm](https://avatars.discourse-cdn.com/v4/letter/v/46a35a/32.png) [@vdsm](https://discuss.elastic.co/u/vdsm)\ **Post date:** [March 6, 2017, 12:13am UTC](https://discuss.elastic.co/t/important-delay-in-the-appearance-of-logs-in-kibana/77330/5 "2017-03-06T00:13:39Z")
I thinks about that, but the delay is not always the same, it can be from 20 to 35 minutes, and rsyslog is correctly setting for the timezone. But I m asking if LS use the same timezone than the host machine ? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 6, 2017, 12:19am UTC](https://discuss.elastic.co/t/important-delay-in-the-appearance-of-logs-in-kibana/77330/6 "2017-03-06T00:19:39Z")
Yes it does. ---
**Author:** ![vdsm](https://avatars.discourse-cdn.com/v4/letter/v/46a35a/32.png) [@vdsm](https://discuss.elastic.co/u/vdsm)\ **Post date:** [March 6, 2017, 8:47am UTC](https://discuss.elastic.co/t/important-delay-in-the-appearance-of-logs-in-kibana/77330/7 "2017-03-06T08:47:11Z")
Well, I'm looking for issues in timezone settings, and effectively /etc/timezone give me wrong timezone. I changed it for the good one, now, Rsyslog and ELK server have the same timezone. I rebooting the server after that. After all services started, logs arrived at time but after few minutes, delay is starting again gradually until about +/- 30 minutes ... ---
**Author:** ![vdsm](https://avatars.discourse-cdn.com/v4/letter/v/46a35a/32.png) [@vdsm](https://discuss.elastic.co/u/vdsm)\ **Post date:** [March 9, 2017, 8:08am UTC](https://discuss.elastic.co/t/important-delay-in-the-appearance-of-logs-in-kibana/77330/8 "2017-03-09T08:08:29Z")
Is anyone else got an idea ? Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 6, 2017, 8:08am UTC](https://discuss.elastic.co/t/important-delay-in-the-appearance-of-logs-in-kibana/77330/9 "2017-04-06T08:08:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.