# Kibana takes time to show data in Discover **URL:** \ **Category:** Kibana\ **Created:** [June 16, 2017, 12:13pm UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707 "2017-06-16T12:13:56Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)\ **Post date:** [June 16, 2017, 12:13pm UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707/1 "2017-06-16T12:13:56Z")
Hello, Elasticsearch is getting data (way enough to show on Kibana). But my problem is that Kibana starts showing data only a few hours after its start. Meaning I miss the visualization of hours of data. Any idea? ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [June 17, 2017, 6:18am UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707/2 "2017-06-17T06:18:36Z")
that shouldn't be the case ... can you see your data in discover mode ? (select time range last 30 minutes and see if any data is there for your selected index pattern) ---
**Author:** ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)\ **Post date:** [June 17, 2017, 12:26pm UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707/3 "2017-06-17T12:26:00Z")
That's the problem. Discover doesn't show any data. It starts showing around 5hours after I start ELK. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 19, 2017, 8:31am UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707/4 "2017-06-19T08:31:07Z")
Elasticsearch and Kibana requires all timestamp fields to be in UTC timezone. Can you verify that timestamps in indexed data is indeed in UTC? ---
**Author:** ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)\ **Post date:** [June 19, 2017, 8:34am UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707/5 "2017-06-19T08:34:09Z")
I don't know if the timestamp is UTC but why would Kibana starts showing logs after a few hours? If the timestamp would be wrong Kibana wouldn't show anything I guess. How should I know id the data is in UTC? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 19, 2017, 8:40am UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707/6 "2017-06-19T08:40:17Z")
Look at the log entries in discover mode, and inspect the JSON. What do the timestamp(s) look like? How are you processing timestamps in your ingest pipeline? Based on your description another possible cause could be that your documents are being delayed throughout the ingest process. What does your pipeline look like? ---
**Author:** ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)\ **Post date:** [June 19, 2017, 8:49am UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707/7 "2017-06-19T08:49:49Z")
Timestamp : ``` "@timestamp": [ 1497862009000 ] ``` Pipeline ``` filter { grok { add_tag => ["firewall"] match => ["message", "<(?.*)>(?(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\s+(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:[0-5][0-9])) (?.*?): (?.*)" ] } mutate { gsub => ["datetime", " ", " "] } date { match => ["datetime", "MMM dd HH:mm:ss"] } mutate { replace => ["message", "%{msg}"] } mutate { remove_field => ["msg", "datetime"] } if [prog] =~ /^filterlog$/ { mutate { remove_field => ["msg", "datetime"] } grok { patterns_dir => "/etc/logstash/conf.d/patterns" match => [ "message", "%{PFSENSE_LOG_DATA}%{PFSENSE_IP_SPECIFIC_DATA}%{PFSENSE_IP_DATA}%{PFSENSE_PROTOCOL_DATA}", "message", "%{PFSENSE_LOG_DATA}%{PFSENSE_IPv4_SPECIFIC_DATA_ECN}%{PFSENSE_IP_DATA}%{PFSENSE_PROTOCOL_DATA}" ] } mutate { lowercase => ['proto'] } geoip { add_tag => ["GeoIP"] source => "src_ip" # Optional GeoIP database # Comment out the below if you do not wise to utilize and omit last three steps dealing with (recommended) suffix # database => "/usr/share/GeoIP/GeoLiteCountry.dat" } } } ``` The output sends everything to Elasticsearch (that part works perfectly). ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 19, 2017, 8:52am UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707/8 "2017-06-19T08:52:30Z")
Can you share a sample event that has shown up late? Which time zone are you in? ---
**Author:** ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)\ **Post date:** [June 19, 2017, 8:55am UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707/9 "2017-06-19T08:55:31Z")
My timezone is UTC + 2 (summer time). No data showed up late. Kibana simply starts showing data after a few hours, meaning that the first hours the data gets to Elasticsearch but NEVER show up in Kibana. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 17, 2017, 8:55am UTC](https://discuss.elastic.co/t/kibana-takes-time-to-show-data-in-discover/89707/10 "2017-07-17T08:55:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.