# Can't retrieve logs

**URL:** https://community.graylog.org/t/cant-retrieve-logs/17913
**Category:** Graylog Central (peer support)
**Created:** [November 20, 2020, 10:13am UTC](https://community.graylog.org/t/cant-retrieve-logs/17913 "2020-11-20T10:13:03Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![davzar](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@davzar](https://community.graylog.org/u/davzar)
#### Post date: [November 20, 2020, 10:13am UTC](https://community.graylog.org/t/cant-retrieve-logs/17913/1 "2020-11-20T10:13:03Z")

</div>

Hi everybody,  
i have a problem with my Graylog appliance:  
in System\Graylog-Cluster\Outgoing-messages i see that on 26 October we had 7.86 Gb of messages stored, but if i search for those messages, i have no results.  
How can i retrieve these logs? Can i serach for them on ssh terminal?

---

<div class="post-metadata">

### Author: ![zoulja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/zoulja/32/3603_2.png) [@zoulja](https://community.graylog.org/u/zoulja)
#### Post date: [November 20, 2020, 4:51pm UTC](https://community.graylog.org/t/cant-retrieve-logs/17913/2 "2020-11-20T16:51:51Z")

</div>

> [@davzar](#):
>
> but if i search for those messages

Usually it’s related to timestamp parsing.  
Try to check other dates

---

<div class="post-metadata">

### Author: ![davzar](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@davzar](https://community.graylog.org/u/davzar)
#### Post date: [November 23, 2020, 1:29pm UTC](https://community.graylog.org/t/cant-retrieve-logs/17913/3 "2020-11-23T13:29:49Z")

</div>

Hi zoulja,  
thanks for your answer.  
Can you please tell me how should i do that?

---

<div class="post-metadata">

### Author: ![zoulja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/zoulja/32/3603_2.png) [@zoulja](https://community.graylog.org/u/zoulja)
#### Post date: [November 23, 2020, 4:55pm UTC](https://community.graylog.org/t/cant-retrieve-logs/17913/4 "2020-11-23T16:55:39Z")

</div>

Have you tried to check “Show all messages” in the Input/Sidecar?  
So no matter when log was received you will see it

---

<div class="post-metadata">

### Author: ![davzar](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@davzar](https://community.graylog.org/u/davzar)
#### Post date: [November 24, 2020, 9:24am UTC](https://community.graylog.org/t/cant-retrieve-logs/17913/5 "2020-11-24T09:24:42Z")

</div>

Tried to put Show all messages, and went backwards to retrieve the Log, but it showed this error

esult window is too large, from + size must be less than or equal to: [10000] but was [132600]. See the scroll api for a more efficient way to request large data sets. This limit can be set by changing the [index.max\_result\_window] index level setting

---

<div class="post-metadata">

### Author: ![zoulja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/zoulja/32/3603_2.png) [@zoulja](https://community.graylog.org/u/zoulja)
#### Post date: [November 25, 2020, 7:57am UTC](https://community.graylog.org/t/cant-retrieve-logs/17913/6 "2020-11-25T07:57:52Z")

</div>

Oh wow. Need someone from Graylog team to comment on this, I’ve never met such error before

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [December 9, 2020, 7:57am UTC](https://community.graylog.org/t/cant-retrieve-logs/17913/7 "2020-12-09T07:57:55Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
