# Intermittent logging

**URL:** <https://discuss.elastic.co/t/intermittent-logging/188068>\
**Category:** Elasticsearch\
**Created:** [June 28, 2019, 2:58pm UTC](https://discuss.elastic.co/t/intermittent-logging/188068 "2019-06-28T14:58:17Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![VeeT](https://avatars.discourse-cdn.com/v4/letter/v/f05b48/32.png) [@VeeT](https://discuss.elastic.co/u/VeeT)\
**Post date:** [June 28, 2019, 2:58pm UTC](https://discuss.elastic.co/t/intermittent-logging/188068/1 "2019-06-28T14:58:17Z")

</div>

Hi. We are using ELK 7.1 and we are seeing some intermittent logging for a particular appName. When checking Kibana, there were a couple of hours of missed logs yesterday and no log on the 26th. However, there were some logs from other apps. There should have been logs because an error was manually pushed on those times. What could be the issue for this?

---

<div class="post-metadata">

**Author:** ![VeeT](https://avatars.discourse-cdn.com/v4/letter/v/f05b48/32.png) [@VeeT](https://discuss.elastic.co/u/VeeT)\
**Post date:** [July 1, 2019, 6:53pm UTC](https://discuss.elastic.co/t/intermittent-logging/188068/2 "2019-07-01T18:53:19Z")

</div>

Hi. Does anyone know what could be the issue? Thanks!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 2, 2019, 5:23am UTC](https://discuss.elastic.co/t/intermittent-logging/188068/3 "2019-07-02T05:23:35Z")

</div>

You have not provided much to go on so it is hard to help. Is there anything in the Elasticsearch logs?

---

<div class="post-metadata">

**Author:** ![VeeT](https://avatars.discourse-cdn.com/v4/letter/v/f05b48/32.png) [@VeeT](https://discuss.elastic.co/u/VeeT)\
**Post date:** [July 8, 2019, 6:45pm UTC](https://discuss.elastic.co/t/intermittent-logging/188068/4 "2019-07-08T18:45:54Z")

</div>

Hi. Yes, we are getting logs on Elasticsearch.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 8, 2019, 6:47pm UTC](https://discuss.elastic.co/t/intermittent-logging/188068/5 "2019-07-08T18:47:36Z")

</div>

Is there anything of interest in the logs, e.g. errors, warnings or evidence of long or frequent GC?

---

<div class="post-metadata">

**Author:** ![VeeT](https://avatars.discourse-cdn.com/v4/letter/v/f05b48/32.png) [@VeeT](https://discuss.elastic.co/u/VeeT)\
**Post date:** [July 8, 2019, 8:52pm UTC](https://discuss.elastic.co/t/intermittent-logging/188068/6 "2019-07-08T20:52:33Z")

</div>

The one that sticks out to me is this log:  
"Authentication of [kibana] was terminated by realm [reserved] - failed to authenticate user [kibana]"

I'm also trying to fix this issue. We have this in the config file (syslog.conf):  
input {  
syslog {  
port =\> 5044  
id =\> "syslog\_id"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["000.00.00.01:9200", "000.00.00.02:9200", "000.00.00.03:9200"]  
sniffing =\> true  
manage\_template =\> false  
index =\> "ss-logs-%{+YYYY.MM.dd}"  
user =\> "{ES\_USER}" password =\> "{ES\_PWD}"  
}  
}

We're using logstash.keystore. I'm not sure if there are related.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 5, 2019, 8:52pm UTC](https://discuss.elastic.co/t/intermittent-logging/188068/7 "2019-08-05T20:52:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.