# Kibana not updating index in Discover

**URL:** <https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885>\
**Category:** Elasticsearch\
**Created:** [April 26, 2023, 9:28pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885 "2023-04-26T21:28:26Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [April 26, 2023, 9:28pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/1 "2023-04-26T21:28:26Z")

</div>

Hi All,

I see this issue where Kibana is not updating index on the "Discover" page while there is a definite increase in the size of the related index. Also for some reason Discover page shows data with one hour interval. Please see below:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/4/443f5b7fb7dc6bf955171ad4fc3292233494aa3f.png)

The "Storage Size" keeps incrementing with no corresponding display on the "Discover" page

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/9/d90b3e0eb3fde9ab9ae473112c787fce5f38d9b0.png)

Health of the hosting servers in terms of CPU and memory is fairly ok.

Please guide.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 26, 2023, 9:36pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/2 "2023-04-26T21:36:16Z")

</div>

Hi @zaeemmasood

There are a couple of possible reasons this could happen.

What is the refresh interval set to? The docs will not show until the refresh interval is past.

More likely what is happening is that the incoming documents are outside your time selection... i.e. you have some old logs coming in that are before your time window (or the are coming in ahead if you have a timezone miss-match) ... so open up / widen the time frame and see if it aligns.

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [April 26, 2023, 9:41pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/3 "2023-04-26T21:41:17Z")

</div>

Thanks.

I am doing manual refresh after setting interval as last 5 hours.

Even if I set it to last 15 minutes it doesnt show any data while the index size increases gradually.

I know for sure that the data is continuously coming in.

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [April 26, 2023, 9:45pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/4 "2023-04-26T21:45:47Z")

</div>

Also a very strange thing was noted. I see that the index size "Storage size" gets reduced now. Notice it was 123.1 gb earlier

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/a/7a4ec5ab6b13d550dcb0d338791fa42993e01663.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 26, 2023, 9:46pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/5 "2023-04-26T21:46:55Z")

</div>

> [@zaeemmasood](#):
>
> I am doing manual refresh after setting interval as last 5 hours.

I am not talking about Refresh in Kibana .... I am talking about the refresh interval at the index level but that is probably not the issue...

In short the most likely logs that are coming in ... are not within the time window you are looking at.

So try this set the time interval to the following

Last 7 Days (or 14 Days) and 1 Day in the future.

 ![Screenshot 2023-04-26 at 2.44.52 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a24f8a8c25bb38cc79a484bb5d89089414e8be01.png)  
 ![Screenshot 2023-04-26 at 2.44.58 PM](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4bbfc3d3f3c965b1d22665aa43f78e6714d951ad.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 26, 2023, 9:53pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/6 "2023-04-26T21:53:39Z")

</div>

Storage can get reduced when a merges (compaction) happens... the doc count looks like it is increasing

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [April 26, 2023, 9:58pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/7 "2023-04-26T21:58:51Z")

</div>

Thanks!

Looks like after I set the date range as per what you said I see continuous stream of messages. See below

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e482bcc35a5bfba03c269ea9c0a427ddcf9651a2.png)

Question is why is it showing time of 11:35AM EST when I refresh just now? Is there a lag somewhere?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 26, 2023, 10:10pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/8 "2023-04-26T22:10:15Z")

</div>

That time stamp you highlighted is the time stamp converted to the Time Zone in the browser OR perhaps you changed a setting in Kibana Advanced Setting...

Discover show relative to the Kibana Setting .. You can see the actual UTC in the document

 ![Screenshot 2023-04-26 at 3.08.03 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/0/7016d9f2273ce26dec8a26d1d2da4cbcd127515c.jpeg)

 ![Screenshot 2023-04-26 at 3.09.09 PM](https://us1.discourse-cdn.com/elastic/original/3X/5/7/570299d1fe27dbef98accb7081b990f34576a630.png)

Could be lag  
Could be time zone issue  
Could be [index refresh interval](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules.html#index-refresh-interval-setting)  
Combination...  
Something else

With out detailed debugging hard to know...

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [April 27, 2023, 2:00pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/9 "2023-04-27T14:00:59Z")

</div>

thanks @stephenb

This set up has been running fine for over 2 years now and this issue has cropped up all of sudden. Also browser setting in terms of Kibana has not changed ever since.

Index refresh interval is set to default 1s.

Servers health has been also showing ok.

That leaves "lag" which could be because of some "network issue".

Please let me know if you agree?

A lot of following errors are also seen in the filebeat log:

```auto
2023-04-27T14:38:20.986+0100 ERROR pipeline/output.go:121 Failed to publish events: write tcp 19.18.28.25:40806->14.18.8.8:5044: write: connection reset by peer
2023-04-27T14:38:21.059+0100 ERROR pipeline/output.go:121 Failed to publish events: write tcp 16.18.28.45:47966->14.12.7.6:5044: write: connection reset by peer

```

Please note that the logstash instance listening on port 5044 consumes more than one feed from various application logs.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 27, 2023, 3:10pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/10 "2023-04-27T15:10:27Z")

</div>

So Lag is most likely the case...

Lag AKA Backpressure can come from many reason or combinations of reasons and can be hard to diagnose... you are going to need to look closely at every step...

> [@zaeemmasood](#):
>
> That leaves "lag" which could be because of some "network issue".

I am not sure I would immediately jump to that... but that certainly could be a reason... I have seen LBs or switches get saturated.

With those error messages it is possible the logstash is getting overwhelmed.

Is there new logs volume being sent to logstash?

You just going to need to dig in... no easy way out 🙂

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [April 27, 2023, 3:28pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/11 "2023-04-27T15:28:21Z")

</div>

Thanks. There has not been any change lately in terms of logs.

Logstash instance listening on port 5044 has around 20 applications pushing logs from various servers and indices getting created. Interestingly, the issue is in only 1 out of the 20 applications. Rest all the 19 apps have their indices getting updated without any delay. The only difference is that 1 application creates the most traffic and has 24 application servers.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 27, 2023, 3:30pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/12 "2023-04-27T15:30:19Z")

</div>

> [@zaeemmasood](#):
>
> The only difference is that 1 application creates the most traffic and has 24 application servers.

Perhaps the Shipping side is not keeping up for that app

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2023, 3:30pm UTC](https://discuss.elastic.co/t/kibana-not-updating-index-in-discover/330885/13 "2023-05-25T15:30:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
