WHY two times run the same day log file count is different

when current time 2017.05.02 yesterday log file count 16G

when i run bellow command line
delete /logstash-nginx-2017.05.01
repeat run the yesterday log file count 25G No duplicate data,Why the total number of results for normal operation analysis is much less

why no data pre 8 hours of one day ?
logfile datetime UTC +08:00

my logstash config file

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.