Syslogs are missing in Kibana

Elastic Stack Kibana
1

Hi ,

I am forwarding syslogs from Entuity to ELK. However, in Kibana a few logs appear to be missing. For example, when I forward the same message 10 times from Entuity to ELK, Kibana shows only 8 or 9. Could you please advise on this?

Regards,

Pratiksha

2

Hello @pratiksha_khalkar

Welcome to the community!!

Could you please share how you are indexing this data (Logstash, Beats or directly to Elasticsearch)?

If you are using Logstash, please check the following:

  • Whether dead_letter_queue is enabled
  • Any pipeline errors in the Logstash logs
  • If there are dropped events (events.in vs events.out)
  • Whether a fingerprint filter or custom document_id is configured (similar records could overwrite each other)

Please review the Elasticsearch logs to see if any documents are being rejected during indexing and note the reason (e.g., mapping conflicts, rejected execution, etc.).

Thanks!!