Missing days on Elastic but command appears to be up to date?

Hi all,

my colleague has informed me that we're missing a couple of days on Elastic. I've had a look and we're missing the 24th and 25th May. I've gone into the command line and reran filebeat -e -d "publisher" and whilst the command has completed and is actively listening for new hits we're still missing these two days in question.

I'll put my hands up though and say I'm no expert with Elastic Stack (and assume we're running it via Kibana. I'll include some images below and would be most appreciative if people could help me diagnose the issue/point in to where I should be looking to try and identify the cause of the issue.

image
image

Apologies in advance if I've accidentally created a duplicate of any old threads that already exists.

Last output from the terminal is the follow (if its of any use)
2022-05-26T13:00:35.337+0100 INFO [monitoring] log/log.go:184 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":44270,"time":{"ms":102}},"total":{"ticks":158890,"time":{"ms":253},"value":158890},"user":{"ticks":114620,"time":{"ms":151}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":10},"info":{"ephemeral_id":"c44e186d-06ef-4cdc-8336-19a8a42cd7be","uptime":{"ms":7920099},"version":"7.17.3"},"memstats":{"gc_next":28452176,"memory_alloc":16957104,"memory_total":13662290136,"rss":120594432},"runtime":{"goroutines":30}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"active":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":1074}},"system":{"load":{"1":0.1,"15":0.13,"5":0.12,"norm":{"1":0.025,"15":0.0325,"5":0.03}}}}}}

Just a quick update. The issue itself wasn't with Elastic, it turned out we were missing some log files from Amazon S3. Ran a PowerShell script to pull the days in question and now ELK is populating the hits correctly.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.