# Kibana is not discovering my new data
**URL:** https://discuss.elastic.co/t/kibana-is-not-discovering-my-new-data/61153
**Category:** Kibana
**Created:** [September 21, 2016, 4:11pm UTC](https://discuss.elastic.co/t/kibana-is-not-discovering-my-new-data/61153 "2016-09-21T16:11:38Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@vk126y](https://discuss.elastic.co/u/vk126y)
#### Post date: [September 21, 2016, 4:11pm UTC](https://discuss.elastic.co/t/kibana-is-not-discovering-my-new-data/61153/1 "2016-09-21T16:11:38Z")
Hi Team,
I was having an ELK up and running and all was going well. Today I updated the conf file of my logstash to read from a SAMBA network drive and thereafter Kibana stops discovering the values.
I verified that :
Item is parsed by logstash, refer below , but there is an error with parsing of my logtime
{
"message" =\> "2016-09-21 20:34:48,882 INFO [bravura.commons.security.SecurityLog] (http-/0.0.0.0:8080-8) Login user not found: nipun",
"@version" =\> "1",
"@timestamp" =\> "2016-09-21T15:04:49.379Z",
"path" =\> "////guvctapfil03.bravurasolutions.local//LOG\_DIR//security.log",
"host" =\> "GURDESKTOP207",
"type" =\> "securitylog",
"year" =\> "2016",
"month" =\> "09",
"day" =\> "21",
"hour" =\> "20",
"min" =\> "34",
"sec" =\> "48",
"msec" =\> "882",
"Loglevel" =\> "INFO",
"JavaClass" =\> "bravura.commons.security.SecurityLog",
"HostName" =\> "http-/0.0.0.0:8080-8",
"Word3" =\> "Login",
"Status" =\> "user",
"Word5" =\> "not",
"Word6" =\> "found",
"User\_Name" =\> "nipun",
"tags" =\> [
[0] "login",
[1] "timestamp-matched"
],
"logtime" =\> "2016-09-21T20:34:48.882Z"
}
**[33mFailed parsing date from field {:field=\>"logtime", :value=\>"%{year}-%{month}-%{day} %{hour}:%{min}:%{sec},%{msec}", :exception=\>"Invalid format: "%{year}-%{month}-%{day} %{hour}:..."", :config\_parsers=\>"yyyy-MM-dd HH:mm:ss,SSS", :config\_locale=\>"default=en\_IN", :level=\>:warn}←[0m**
**Item is searchable in my Elastic Search index. Refer below**
bash-4.3$ curl -XGET '[http://192.168.180.199:9200/login/\_search?q=User\_Name:nipun&pretty=true](http://192.168.180.199:9200/login/_search?q=User_Name:nipun&pretty=true)'
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1257 100 1257 0 0 1387 0 --:--:-- --:--:-- --:--:-- 1387{
"took" : 913,
"timed\_out" : false,
"\_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 1,
"max\_score" : 5.94876,
"hits" : [ {
"\_index" : "login",
"\_type" : "securitylog",
"\_id" : "AVdNRyHiNXuwS9poQOVR",
"\_score" : 5.94876,
"\_source" : {
"message" : "2016-09-21 20:34:48,882 INFO [bravura.commons.security.SecurityLog] (http-/0.0.0.0:808d: nipun",
"@version" : "1",
"@timestamp" : "2016-09-21T15:04:49.379Z",
"path" : "////guvctapfil03.bravurasolutions.local//LOG\_DIR//security.log",
"host" : "GURDESKTOP207",
"type" : "securitylog",
"year" : "2016",
"month" : "09",
"day" : "21",
"hour" : "20",
"min" : "34",
"sec" : "48",
"msec" : "882",
"Loglevel" : "INFO",
"JavaClass" : "bravura.commons.security.SecurityLog",
"HostName" : "http-/0.0.0.0:8080-8",
"Word3" : "Login",
"Status" : "user",
"Word5" : "not",
"Word6" : "found",
"User\_Name" : "nipun",
"tags" : ["login", "timestamp-matched"],
"logtime" : "2016-09-21T20:34:48.882Z"
}
} ]
}
}
_ **The logstash configuration file is as follows** _
iinput {
file {
type =\> "securitylog"
#path =\> ["C:/Users/vikumar/Demo/Logs/Security/\*"]
#path =\> ["////gurdesktop243//log\_VSTrunk//security.log"]
path =\> ["////guvctapfil03.bravurasolutions.local//LOG\_DIR//security.log"]
```
start_position => "beginning"
}
```
}
filter {
```
mutate {
remove_tag => ["_grokparsefailure"]
remove_tag => ["login"]
}
if [type] == "securitylog" {
#Filter for User Login status
grok {
match => { "message" => "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}\s*%{HOUR:hour}:%{MINUTE:min}:%{SECOND:sec},%{NUMBER:msec}\s*%{WORD:Loglevel}\s*\[%{DATA:JavaClass}\]\s*\(%{DATA:HostName}\)\s*%{WORD:Word3}\s*%{WORD:Status}\s%{WORD:Word5}\s%{WORD:Word6}\:\s%{WORD:User_Name}\s?" }
add_tag => "login"
}
mutate {
add_field => {"logtime" =>"%{year}-%{month}-%{day} %{hour}:%{min}:%{sec},%{msec}"
}
}
date {
match => ["logtime" , "yyyy-MM-dd HH:mm:ss,SSS"]
timezone => "UTC"
add_tag => ["timestamp-matched"]
target => "logtime"
}
}
}
```
output {
if "login" in [tags]{
```
stdout { codec => rubydebug }
elasticsearch {
hosts => ["192.168.180.179:9200"]
index => "login"
}
}
```
else{}
#stdout { codec =\> rubydebug }
}
---
### Author:  [@vk126y](https://discuss.elastic.co/u/vk126y)
#### Post date: [September 21, 2016, 4:44pm UTC](https://discuss.elastic.co/t/kibana-is-not-discovering-my-new-data/61153/2 "2016-09-21T16:44:58Z")
I found something very strange , my data is discoverable when I choose the time filter as This Week instead of Last 15 minutes.
But this is wrong because ELK stack is adding + 5: 30 hours to my log event means
if logstash says "logtime" =\> "2016-09-21T22:09:51.472Z" But Kibana shows September 22nd 2016, 03:39:51.472
Why this is so ?? Its strange
---
### Author:  [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)
#### Post date: [September 21, 2016, 7:36pm UTC](https://discuss.elastic.co/t/kibana-is-not-discovering-my-new-data/61153/3 "2016-09-21T19:36:45Z")
Hi Vinay,
I'm not quite sure. This may be more of a question for logstash [Pulling values for properties that have index set to "no"](https://discuss.elastic.co/t/pulling-values-for-properties-that-have-index-set-to-no/61106/2) ?
Kibana indeed only shows what fits in the time range that's configured on the top.
---
### Author:  [@vk126y](https://discuss.elastic.co/u/vk126y)
#### Post date: [September 22, 2016, 6:30pm UTC](https://discuss.elastic.co/t/kibana-is-not-discovering-my-new-data/61153/4 "2016-09-22T18:30:26Z")
Thomas
Thanks for the response , you are right Kibana only shows what fits in time range and as i shared above in my case i don't know somehow +5 hrs were getting added to my logtime and I was thinking data is not recoverable and its a known bug
>
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:38pm UTC](https://discuss.elastic.co/t/kibana-is-not-discovering-my-new-data/61153/5 "2017-07-06T13:38:23Z")