WHY two times run the same day log file count is different

Elastic Stack Elasticsearch
1

when current time 2017.05.02 yesterday log file count 16G

when i run bellow command line
delete /logstash-nginx-2017.05.01
repeat run the yesterday log file count 25G No duplicate data，Why the total number of results for normal operation analysis is much less

image.png1130×245 25.7 KB

2

example
why no data pre 8 hours of one day ?
logfile datetime UTC +08：00

my logstash config file

image.png1654×395 19.9 KB

image.png963×245 11.3 KB

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.