# Logs shown in Kibana are behind the current time

**URL:** https://discuss.elastic.co/t/logs-shown-in-kibana-are-behind-the-current-time/169104
**Category:** Beats
**Tags:** filebeat
**Created:** [February 19, 2019, 8:35pm UTC](https://discuss.elastic.co/t/logs-shown-in-kibana-are-behind-the-current-time/169104 "2019-02-19T20:35:29Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![aleksei.saiko](https://avatars.discourse-cdn.com/v4/letter/a/b9bd4f/32.png) [@aleksei.saiko](https://discuss.elastic.co/u/aleksei.saiko)
#### Post date: [February 19, 2019, 8:35pm UTC](https://discuss.elastic.co/t/logs-shown-in-kibana-are-behind-the-current-time/169104/1 "2019-02-19T20:35:29Z")

</div>

Hello,  
I configured Filebeat, Logstash, ES and Kibana, to gather nginx-ingress logs from Kubernetes.  
Since there's a lot of logs (10 hits in a second), the presented data in Kibana is good, but behind the current time.  
For example , shown logs are for 17:05:24 but now is 17:15, and this delta is getting bigger, because of the amount of logs.  
I tried to use scan\_frequency and close\_inactive in filebeat config

```auto
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-prospectors
  namespace: kube-system
  labels:
    k8s-app: filebeat
    kubernetes.io/cluster-service: "true"
data:
  kubernetes.yml: |-
    - type: docker
      containers.ids:
      - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true
      scan_frequency: 10s
      close_inactive: 1m

```

But it didn't really helps, any best practise for such case?

Thx!

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [February 21, 2019, 2:31pm UTC](https://discuss.elastic.co/t/logs-shown-in-kibana-are-behind-the-current-time/169104/2 "2019-02-21T14:31:09Z")

</div>

The lag might be in Logstash or Elasticsearch. Filebeat tries to read files as fast as possible, but is subject to back-pressure from downstream systems. If Elasticsearch/Logstash can not hold up to the load generated by filebeat, they will force filebeat to slow down.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 21, 2019, 2:31pm UTC](https://discuss.elastic.co/t/logs-shown-in-kibana-are-behind-the-current-time/169104/3 "2019-03-21T14:31:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.