Kibana is late showing results from some hosts

Elastic Stack Kibana
1

Hi,

i have an elastic cloud with 4 hosts and one dummy node (that is not a data nor a master node, as advised here.

my logstash config sends data in a round robin way,

elasticsearch {
    hosts => ['m003', 'm004', 'm005', 'm006']
}

and my kibana is pointing to the dummy node that is part of the same cluster.

What im experiencing is, that kibana have some delay for some of the data (up to 5 mins) and it has no issues for other data (see screenshot for example).

Should i be sending data from logstas to elastic cluster in a different way ?

2

What does the chart show?

3

all the lines except a few stop at 22:45-ish. Those are the late data i am talking about.
But there are a few lines (purple one and a few at the bottom that you cannot see) that have data up to "now" (where now is 22:48-ish

Edit:
Just to clarify, i've never seen all the data aligned and realtime so its probably a wrong setup on my side. The question is what im doing wrong.

4

What happened at 22:45, i.e. why did events from some servers cease to arrive?

The @timestamp values are set by Logstash so the lateness isn't on the Kibana or Elasticsearch side. Are you using Logstash's date filter to populate the @timestamp field with the actual time of the event?

5

Nothing special happened. Kibana displays real time data for a fraction of the servers im collecting data from. All the others are displayed with delay.

The graph is using an x-Axis date historgram aggregation with field @timestamp

6

KB only shows what it can see in ES, so if things appear to stop, then check if there is anything in ES.

7

in that case ill open an elastic topic.

Cheers