# Kibana is missing some logs however I can see that line of information is present in the logs on the server

**URL:** https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997
**Category:** Logstash
**Created:** [February 15, 2018, 1:55pm UTC](https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997 "2018-02-15T13:55:11Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![imarjun](https://avatars.discourse-cdn.com/v4/letter/i/2acd7d/32.png) [@imarjun](https://discuss.elastic.co/u/imarjun)
#### Post date: [February 15, 2018, 1:55pm UTC](https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997/1 "2018-02-15T13:55:11Z")

</div>

I am unable to view a particular log in Kibana interface however that line of log is present in the log file of the application server.

I am searching wih the GUID parameter from below line, but unable to get it in the Kibana GUI  
(17.0.redhat-630310 | LogTimestamp:2018-02-12 18:29:53.848|Severity:INFO|ManagedServer:10.89.249.37:16100|SourceSystemID:OCS|ChannelMedia:WEB|GUID:LTdNRBrkIBSsHFVvBkf8Ewxvn6Yyuqv9\_4bb116)

If I search with other GUID i am able to find them. Please help

logstash-5.5.0  
filebeat-5.5.0-linux-x86\_64  
elasticsearch-5.5.0

---

<div class="post-metadata">

### Author: ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [February 15, 2018, 5:22pm UTC](https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997/2 "2018-02-15T17:22:10Z")

</div>

Can you confirm that the data is in Elasticsearch? Kibana is only searching against data indexed in Elasticsearch, not against the server files themselves. I would suggest confirming that whatever pipeline you have set up to ingest the logs from the application server into ES is working correctly.

---

<div class="post-metadata">

### Author: ![imarjun](https://avatars.discourse-cdn.com/v4/letter/i/2acd7d/32.png) [@imarjun](https://discuss.elastic.co/u/imarjun)
#### Post date: [February 15, 2018, 5:54pm UTC](https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997/3 "2018-02-15T17:54:12Z")

</div>

Hi Bill,

It would be great if you can kindly guide me through this since I am newbie to kibana

---

<div class="post-metadata">

### Author: ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [February 15, 2018, 7:12pm UTC](https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997/4 "2018-02-15T19:12:50Z")

</div>

If you use curl to execute this against your elasticsearch instance:

GET /\_search?q=GUID:LTdNRBrkIBSsHFVvBkf8Ewxvn6Yyuqv9\_4bb116

do you get back any hits? If you do not then the issue is something to do with logstash setup.

---

<div class="post-metadata">

### Author: ![imarjun](https://avatars.discourse-cdn.com/v4/letter/i/2acd7d/32.png) [@imarjun](https://discuss.elastic.co/u/imarjun)
#### Post date: [February 16, 2018, 10:05am UTC](https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997/5 "2018-02-16T10:05:55Z")

</div>

Do I run this on my logstash server?

curl -v 10.89.13.XX:9200 GET /\_search?q=GUID:LTdNRBrkIBSsHFVvBkf8Ewxvn6Yyuqv9\_4bb116

where 10.89.13.XX is my ES server

---

<div class="post-metadata">

### Author: ![imarjun](https://avatars.discourse-cdn.com/v4/letter/i/2acd7d/32.png) [@imarjun](https://discuss.elastic.co/u/imarjun)
#### Post date: [February 16, 2018, 10:12am UTC](https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997/6 "2018-02-16T10:12:05Z")

</div>

[fuseadmin@a0110pcsgmon02 ~]$ curl -v 10.89.13.27:9200/\_search?q=GUID:LTdNRBrkIBSsHFVvBkf8Ewxvn6Yyuqv9\_4bb116

- About to connect() to 10.89.13.27 port 9200 (#0)
- Trying 10.89.13.27...
- Connected to 10.89.13.27 (10.89.13.27) port 9200 (#0)

> GET /\_search?q=GUID:LTdNRBrkIBSsHFVvBkf8Ewxvn6Yyuqv9\_4bb116 HTTP/1.1  
> User-Agent: curl/7.29.0  
> Host: 10.89.13.27:9200  
> Accept: _/_

\< HTTP/1.1 200 OK  
\< content-type: application/json; charset=UTF-8  
\< content-length: 149  
\<

- Connection #0 to host 10.89.13.27 left intact  
{"took":16,"timed\_out":false,"num\_reduce\_phases":2,"\_shards":{"total":611,"successful":611,"failed":0},"hits":{"total":0,"max\_score":null,"hits":}}[

---

<div class="post-metadata">

### Author: ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [February 16, 2018, 2:24pm UTC](https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997/7 "2018-02-16T14:24:03Z")

</div>

So yeah looks like the data is just not in Elasticsearch. You need to look into the configuration of logstash and how the data is getting into Elasticsearch. The Logstash forum should be able to help you.

---

<div class="post-metadata">

### Author: ![imarjun](https://avatars.discourse-cdn.com/v4/letter/i/2acd7d/32.png) [@imarjun](https://discuss.elastic.co/u/imarjun)
#### Post date: [February 16, 2018, 2:28pm UTC](https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997/8 "2018-02-16T14:28:19Z")

</div>

Hi Logstash Team, can you please check and help us on resolving this.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2018, 2:28pm UTC](https://discuss.elastic.co/t/kibana-is-missing-some-logs-however-i-can-see-that-line-of-information-is-present-in-the-logs-on-the-server/119997/9 "2018-03-16T14:28:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
