Mismatch in count of actual log and log inserted on ES

Elastic Stack Logstash
#1

Hello,

I have inserted few logs in ES using logstash. But when I check the count of actual log and data inserted in ES, it is not matching. Seems like logstash is dropping few messages.

If I check the count in kibana using "ab.cd:device", I get 2000
and
count of cd=device gives 2001

So my question is where is my 1 log and why is it not showing in first query.

Ajays

#2

Have you checked the Logstash logs? Are there any errors?

#3

I used rubydebug in logstash configuration and send the output to a file. When I checked the file I found no error at all. I thought I would get one _grokparsefailure error but I got no errors at all.

#4