# Kibana is late showing results from some hosts

**URL:** <https://discuss.elastic.co/t/kibana-is-late-showing-results-from-some-hosts/36106>\
**Category:** Kibana\
**Created:** [December 1, 2015, 10:49pm UTC](https://discuss.elastic.co/t/kibana-is-late-showing-results-from-some-hosts/36106 "2015-12-01T22:49:53Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![MikeC](https://avatars.discourse-cdn.com/v4/letter/m/977dab/32.png) [@MikeC](https://discuss.elastic.co/u/MikeC)\
**Post date:** [December 1, 2015, 10:49pm UTC](https://discuss.elastic.co/t/kibana-is-late-showing-results-from-some-hosts/36106/1 "2015-12-01T22:49:53Z")

</div>

Hi,

i have an elastic cloud with 4 hosts and one dummy node (that is not a data nor a master node, as advised [here](https://www.elastic.co/guide/en/kibana/current/production.html#load-balancing).

my logstash config sends data in a round robin way,

```
elasticsearch {
    hosts => ['m003', 'm004', 'm005', 'm006']
}

```

and my kibana is pointing to the dummy node that is part of the same cluster.

What im experiencing is, that kibana have some delay for some of the data (up to 5 mins) and it has no issues for other data (see screenshot for example).

Should i be sending data from logstas to elastic cluster in a different way ?

![](https://us1.discourse-cdn.com/elastic/original/2X/7/7190ff2254c8a1ee23cd06034da3d74f3ee243f6.png)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 2, 2015, 7:14am UTC](https://discuss.elastic.co/t/kibana-is-late-showing-results-from-some-hosts/36106/2 "2015-12-02T07:14:50Z")

</div>

What does the chart show?

---

<div class="post-metadata">

**Author:** ![MikeC](https://avatars.discourse-cdn.com/v4/letter/m/977dab/32.png) [@MikeC](https://discuss.elastic.co/u/MikeC)\
**Post date:** [December 2, 2015, 9:10am UTC](https://discuss.elastic.co/t/kibana-is-late-showing-results-from-some-hosts/36106/3 "2015-12-02T09:10:07Z")

</div>

all the lines except a few stop at 22:45-ish. Those are the late data i am talking about.  
But there are a few lines (purple one and a few at the bottom that you cannot see) that have data up to "now" (where now is 22:48-ish

Edit:  
Just to clarify, i've never seen all the data aligned and realtime so its probably a wrong setup on my side. The question is what im doing wrong.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 2, 2015, 10:51am UTC](https://discuss.elastic.co/t/kibana-is-late-showing-results-from-some-hosts/36106/4 "2015-12-02T10:51:53Z")

</div>

What happened at 22:45, i.e. why did events from some servers cease to arrive?

The `@timestamp` values are set by Logstash so the lateness isn't on the Kibana or Elasticsearch side. Are you using Logstash's date filter to populate the `@timestamp` field with the actual time of the event?

---

<div class="post-metadata">

**Author:** ![MikeC](https://avatars.discourse-cdn.com/v4/letter/m/977dab/32.png) [@MikeC](https://discuss.elastic.co/u/MikeC)\
**Post date:** [December 2, 2015, 1:03pm UTC](https://discuss.elastic.co/t/kibana-is-late-showing-results-from-some-hosts/36106/5 "2015-12-02T13:03:29Z")

</div>

> [@magnusbaeck](#):
>
> What happened at 22:45, i.e. why did events from some servers cease to arrive?

Nothing special happened. Kibana displays real time data for a fraction of the servers im collecting data from. All the others are displayed with delay.

The graph is using an x-Axis `date historgram` aggregation with field `@timestamp`

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 3, 2015, 5:07am UTC](https://discuss.elastic.co/t/kibana-is-late-showing-results-from-some-hosts/36106/6 "2015-12-03T05:07:00Z")

</div>

KB only shows what it can see in ES, so if things appear to stop, then check if there is anything in ES.

---

<div class="post-metadata">

**Author:** ![MikeC](https://avatars.discourse-cdn.com/v4/letter/m/977dab/32.png) [@MikeC](https://discuss.elastic.co/u/MikeC)\
**Post date:** [December 3, 2015, 8:18pm UTC](https://discuss.elastic.co/t/kibana-is-late-showing-results-from-some-hosts/36106/7 "2015-12-03T20:18:02Z")

</div>

in that case ill open an elastic topic.

Cheers

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:07pm UTC](https://discuss.elastic.co/t/kibana-is-late-showing-results-from-some-hosts/36106/8 "2017-07-06T14:07:31Z")

</div>


