# Messages always last 2,33 minutes since I put REDIS **URL:** \ **Category:** Logstash\ **Created:** [January 22, 2016, 5:20pm UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907 "2016-01-22T17:20:15Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![billy6](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@billy6](https://discuss.elastic.co/u/billy6)\ **Post date:** [January 22, 2016, 5:20pm UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907/1 "2016-01-22T17:20:15Z")
Hello, I changed my log architecture for this one, because I wanted to be able to handle more messages per second, I placed REDIS in one server and another server is taken the messages from there. ![](https://us1.discourse-cdn.com/elastic/original/2X/5/528c11106cbe80810ce29ae4fbffd43daf364cb6.png) Now I have a very high latency problem. Every message last 2,33 minutes since I send the message until it appear in Kibana. What should I do to increase the speed? I have tried with 2,4, and 8 workers, but I obtain the same results. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 24, 2016, 4:16am UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907/2 "2016-01-24T04:16:10Z")
How are you tracking this? ---
**Author:** ![billy6](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@billy6](https://discuss.elastic.co/u/billy6)\ **Post date:** [January 25, 2016, 8:51am UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907/3 "2016-01-25T08:51:34Z")
Every message has it own timestamp when the user is sending it, and in the second logstash instance I put another tag with a second timestamp. The difference between both of them is always exactly 2.3333 minutes (140 seconds). In my previous version (without using REDIS and ELK stack in only one machine) I used to have a 10 ms of difference, which was OK, but I used to lose messages when I have a high rate of data. I have tried it with several configuration of workers, and I obtain the same results. Here is a graph with the difference between tags. ![](https://us1.discourse-cdn.com/elastic/original/2X/0/08b4ed078614be0bfae415d1ca74f2d19d9e52de.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 25, 2016, 8:54am UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907/4 "2016-01-25T08:54:09Z")
What's your config look like? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 25, 2016, 9:05am UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907/5 "2016-01-25T09:05:22Z")
It seems odd to have such a consistent lag. Is the server time synchronised between the servers assigning timestamps? ---
**Author:** ![billy6](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@billy6](https://discuss.elastic.co/u/billy6)\ **Post date:** [January 25, 2016, 9:57am UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907/6 "2016-01-25T09:57:07Z")
This is the config file in the first machine: ``` input { udp { type => "udp" port => 30000 } gelf { type =>"log4j" port =>4560 host =>"0.0.0.0" } } output { redis{ host => "127.0.0.1" data_type => "list" key => "logstash" codec => json } } ``` And this is the config in the second machine: ``` input { udp { type => "udp" port => 30000 } redis { host => "HOST IP" data_type => "list" type => "redis" key => "logstash" codec => json } } filter { if [type] == "udp" { mutate { rename => ["@host", "host"] } dns { reverse => ["host"] action => "replace" nameserver => "127.0.0.1" } grok { patterns_dir => "/etc/logstash/patterns" match => [ "message", "%{MESSAGE_1}", "message", "%{MESSAGE_2}", "message", "%{MESSAGE_3}" ] } } } output { elasticsearch { cluster => "logstash" host => "127.0.0.1" index => "logstash-syslog-%{+YYYY.MM.dd}" } } ``` I am using a DNS cache, for that reason I have written nameserver as the localhost. I am using a pattern file for the match. ``` DATER %{YEAR}[/]%{MONTHNUM}[/]%{MONTHDAY}[]%{TIME} APPNAME [()a-zA-Z0-9._:-]+ SOURCEDATA [()a-zA-Z0-9._:-]+ LOGLEVEL (INFO|WARNING|ERROR) MESSAGE_1 (?m)%{DATER:dater} \[%{APPNAME:app_name}\] \[%{LOGLEVEL:log_level}\] \<%{BASE10NUM:error_code}\> -> %{GREEDYDATA:Comment} MESSAGE_2.... ... ``` I think it's not a problem of synchronization, I have checked sending one message and clocking how much time it spends and it was the same result. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 25, 2016, 10:10am UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907/7 "2016-01-25T10:10:51Z")
Is it a time issue, as Christian mentioned? ---
**Author:** ![billy6](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@billy6](https://discuss.elastic.co/u/billy6)\ **Post date:** [January 25, 2016, 10:47am UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907/8 "2016-01-25T10:47:38Z")
Yes... the time was not synchronized... and that was the problem. Thank you so much! @Christian_Dahlqvist@warkolm You are great! Have a nice day! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:14am UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907/9 "2017-07-06T05:14:29Z")
Closed on July 6, 2017, 5:14am UTC