# Logs not reaching from all the servers on ES/Kibana

**URL:** <https://discuss.elastic.co/t/logs-not-reaching-from-all-the-servers-on-es-kibana/166501>\
**Category:** Logstash\
**Created:** [January 31, 2019, 8:48am UTC](https://discuss.elastic.co/t/logs-not-reaching-from-all-the-servers-on-es-kibana/166501 "2019-01-31T08:48:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Harsh\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harsh_sharma/32/32093_2.png) [@Harsh\_Sharma](https://discuss.elastic.co/u/Harsh_Sharma)\
**Post date:** [January 31, 2019, 8:48am UTC](https://discuss.elastic.co/t/logs-not-reaching-from-all-the-servers-on-es-kibana/166501/1 "2019-01-31T08:48:36Z")

</div>

I'm using ELK 6.5.4  
Filebeat = 10 nodes of Nginx  
Logstash Server = 1 nodes(10.5.202.201) = (8 core, 128GB Ram) || **3 nodes = 1 node of** (8 core, 128GB Ram) **& 2 nodes of** (2 core, 4GB RAM)

I'm getting logs from 2 nodes (nginx001 & nginx002) of nginx. While checking logstash logs in debug mode I'm getting logs from another servers too but those logs are not shown on Kibana.

Sample logstash log where I'm getting logs from node nginx008 too. (Likewise I'm getting logs from nginx001 to nginx010). But in Kibana only 2 nodes logs (nginx001 & nginx002) are showing.

> `[2019-01-31T13:43:57,555][DEBUG][logstash.pipeline] filter received {"event"=&gt;{"input"=&gt;{"type"=&gt;"log"}, "message"=&gt;"10.5.10.10 - - [31/Jan/2019:10:30:36 +0530] \"GET /my/v2/home/ham2?density=XHDPI HTTP/1.1\" 200 6689 \"-\" \"Dalvik/2.1.0 (Linux; U; Android 6.0.1; HTC Desire 10 lifestyle Build/MMB29M)\"ResponseTime=0.006 BackendConnectTime=\"0.000\" BackendResponseTime=\"0.006\" backend_host=\"10.5.2.2:8080\"", "source"=&gt;"/data/nginx/access.log", "tags"=&gt;["beats_input_codec_plain_applied"], "@version"=&gt;"1", "offset"=&gt;889329952, "host"=&gt;{"containerized"=&gt;true, "name"=&gt;" **nginx008**", "os"=&gt;{"platform"=&gt;"rhel", "version"=&gt;"7.5 (Maipo)", "codename"=&gt;"Maipo", "family"=&gt;""}, "architecture"=&gt;"x86_64", "id"=&gt;"7ea08555621c4ac68fa586f12e9a9a46"}, "log_type"=&gt;"maa-nginx-log", "beat"=&gt;{"name"=&gt;" **nginx008**", "version"=&gt;"6.5.4", "hostname"=&gt;" **nginx008**"}, "@timestamp"=&gt;2019-01-31T08:13:53.802Z, "prospector"=&gt;{"type"=&gt;"log"}}}`

If I stop all filebeat & test one filebeat at a time then there is no issue all servers logs will appear. But when I start all filebeats It shows logs from 2 nodes only or sometime 4 nodes but never all nodes logs at a time.

Filebeat Config -

```
> filebeat.inputs:
> - type: log
> enabled: true
> paths:
> - /data/nginx/access.log
> fields:
> log_type: maa-nginx-log
> fields_under_root: true
> 
> ignore_older: 2m
> 
> filebeat.config.modules:
> # Glob pattern for configuration loading
> path: ${path.config}/modules.d/*.yml
> 
> # Set to true to enable config reloading
> reload.enabled: false
> setup.template.settings:
> index.number_of_shards: 3
> 
> output.logstash:
> hosts: ["10.5.202.201:5044"]
> # hosts: ["10.5.202.201:5044", "10.5.202.202:5044", "10.5.202.203:5044"]
> loadbalance: true
> worker: 4

```

Please suggest what am I missing & can do to fix this weird problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2019, 8:48am UTC](https://discuss.elastic.co/t/logs-not-reaching-from-all-the-servers-on-es-kibana/166501/2 "2019-02-28T08:48:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.