# Some log missing in elasticsearch

**URL:** <https://discuss.elastic.co/t/some-log-missing-in-elasticsearch/355122>\
**Category:** Elasticsearch\
**Created:** [March 11, 2024, 7:06am UTC](https://discuss.elastic.co/t/some-log-missing-in-elasticsearch/355122 "2024-03-11T07:06:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Frances\_Chu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frances_chu/32/127298_2.png) [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\
**Post date:** [March 11, 2024, 7:06am UTC](https://discuss.elastic.co/t/some-log-missing-in-elasticsearch/355122/1 "2024-03-11T07:06:59Z")

</div>

I try to transfer logs from filebeat to logstash at time A  
The log is located in the filebeat server //filebeatserver/log/LogtoLogstash/\*  
(including log before time A)

The log is OK starting from time A.  
However, it is found i can only receive some logs before time A.  
Any idea?

Would that be related to the problem of Filebeat or logstash?  
Unfortunately, there are no error found in logstash.plain.log  
As there are lots of files...is it related to the max no. of file open?

 ![Problem](https://us1.discourse-cdn.com/elastic/original/3X/a/c/acb7ff98892c3a40a188ca98d6569762d614bba6.png)

---

<div class="post-metadata">

**Author:** ![Frances\_Chu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frances_chu/32/127298_2.png) [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\
**Post date:** [March 12, 2024, 1:49am UTC](https://discuss.elastic.co/t/some-log-missing-in-elasticsearch/355122/2 "2024-03-12T01:49:56Z")

</div>

Although I cannot find any error message from both filebeat and logstash.  
I try to resend the logs from filebeat. It is confirmed all logs are OK.  
It means it is not the business of filebeat..may be ...the problem is in logstash to handle a large amount of data in a short time. ....just thinking how to notice and prevent that kind of issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2024, 1:50am UTC](https://discuss.elastic.co/t/some-log-missing-in-elasticsearch/355122/3 "2024-04-09T01:50:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.