# Logstash data duplication... possible?

**URL:** <https://discuss.elastic.co/t/logstash-data-duplication-possible/2336>\
**Category:** Logstash\
**Created:** [June 10, 2015, 2:36pm UTC](https://discuss.elastic.co/t/logstash-data-duplication-possible/2336 "2015-06-10T14:36:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alexolivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexolivan/32/57425_2.png) [@alexolivan](https://discuss.elastic.co/u/alexolivan)\
**Post date:** [June 10, 2015, 2:37pm UTC](https://discuss.elastic.co/t/logstash-data-duplication-possible/2336/1 "2015-06-10T14:37:00Z")

</div>

Hi forum...

Today's surprise on the cluster is my logstash-forwarder nodes seeming to have miss a lot of data during night... they appeared to run normally... but the amount of logs received is a portion owhat should be there.  
By restarting logstash-forwarder, I see lot of 100 entry packets being sended all the sudden to logstas server... so I updated the cron to periodically restart logstash-forwarder sice it seems to stall on logrotation, full moon or don't know what at night hehehe.

Today... I see a load of log entries at night, at a moment where activity is iddle! so it seems tons of data has arrived all of the sudden, and timestamped at system arrival time.  
Is this normal?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:37am UTC](https://discuss.elastic.co/t/logstash-data-duplication-possible/2336/2 "2017-07-06T05:37:52Z")

</div>

Closed on July 6, 2017, 5:37am UTC