Index pattern unable lo display/load the the index data

HI all,

I am using ELK stack of version 7.1.1 with x-pack installed.

i am able to create an index pattern but my documents are not appearing in the that index pattern.

I have created an index pattern which matches my index


completion of pattern creation with timestamo filter

Cross verified whether it has documents in it or not

But on the discover section. i'm not able to see those logs

and im able to see my syslogs in syslog-* but not able to see logstash indices logs in logstash-*
i'm so confused please help solve it.


It looks like your Time Filter is set to just show logs from "Today". Expand it to include a wide date/time range and you should have better luck!


FWIW, I noticed that your Logstash index was created today, so I assume that the documents it contains are timestamped with today's date too. To complement Aaron's good suggestion, you can also use Console to search your logstash index and verify that the timestamps fall within the time range you're specifying in Discover. If that's the case but Discover is still not showing any results, would you mind sharing a screenshot of the search results in Console with the timestamp visible?

Thanks @Aaron_Caldwell and @cjcenizal , Sorry ,
my bad i didn't checked it properly i have made few changes in logstash filter, now i'm getting the logs with the current data and timestamp.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.