# Missing Data in Graylog, but in ElasticSearch

**URL:** <https://community.graylog.org/t/missing-data-in-graylog-but-in-elasticsearch/15096>\
**Category:** Graylog Central (peer support)\
**Created:** [April 23, 2020, 1:19am UTC](https://community.graylog.org/t/missing-data-in-graylog-but-in-elasticsearch/15096 "2020-04-23T01:19:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![arrmo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/arrmo/32/6315_2.png) [@arrmo](https://community.graylog.org/u/arrmo)\
**Post date:** [April 23, 2020, 1:19am UTC](https://community.graylog.org/t/missing-data-in-graylog-but-in-elasticsearch/15096/1 "2020-04-23T01:19:05Z")

</div>

Hi,

OK, pulling my hair out (and I don’t have enough to spare … 😄). I am sending data to Graylog, from rsyslog. I have used tcpdump, to make sure that the packets are getting there … they are. So then I query from ElasticSearch, using the API - example below, and data showing up,  
`curl -X GET "localhost:9200/graylog_0/_search?q=source:wap-attic&pretty"`

I also used the API, to check the count - a bunch of records there,

```
curl -X GET "localhost:9200/graylog_0/_count?q=source:wap-attic&pretty"
{
  "count" : 69,
  "_shards" : {
    "total" : 4,
    "successful" : 4,
    "skipped" : 0,
    "failed" : 0
  }
}

```

But then I try exactly the same query (string) as above, in the Graylog GUI (selecting all time) =\> no records found! I wonder if it’s an issue with timezone (FYI, I’m sending from rsyslog in RSYSLOG\_SyslogProtocol23Format … but have tried others, no joy). I say TZ, because if I look at one record from the API query - the time looks to be in the future, which makes no real sense. But could that be why nothing is showing up in the Graylog web interface?

Of course, how to fix the TZ also, if that is it ☹

Thanks!

---

<div class="post-metadata">

**Author:** ![arrmo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/arrmo/32/6315_2.png) [@arrmo](https://community.graylog.org/u/arrmo)\
**Post date:** [April 23, 2020, 3:02am UTC](https://community.graylog.org/t/missing-data-in-graylog-but-in-elasticsearch/15096/2 "2020-04-23T03:02:07Z")

</div>

OK, found it! If /etc/localtime is missing (which it is on this / some systems), the time is sent as (examples here),  
`2020-04-23T02:47:21.749833+00:00`

Instead of,  
`2020-04-22T21:57:56.574015-05:00`

But this should be accepted, no? They are the same thing, and the offset is shown. So why is Graylog ignoring the log entry? It is seen in ElasticSearch.

Thanks!

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [May 6, 2020, 1:20pm UTC](https://community.graylog.org/t/missing-data-in-graylog-but-in-elasticsearch/15096/3 "2020-05-06T13:20:33Z")

</div>

@arrmo

the question is - how did you search in Graylog?

Graylog does honour the timezone of the local user - when you search in the last 5 minutes it will take the timezone from the user profil to search the last 5 minutes.

If your ingested messages are not from within this time range they will not show up.

---

<div class="post-metadata">

**Author:** ![arrmo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/arrmo/32/6315_2.png) [@arrmo](https://community.graylog.org/u/arrmo)\
**Post date:** [May 6, 2020, 6:11pm UTC](https://community.graylog.org/t/missing-data-in-graylog-but-in-elasticsearch/15096/4 "2020-05-06T18:11:11Z")

</div>

Hi,

I wasn’t limiting Graylog to any time range, rather just querying for that particular source, but without a time limitation. Similar to the curl query above, but in Graylog (vs. ES).

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 20, 2020, 6:11pm UTC](https://community.graylog.org/t/missing-data-in-graylog-but-in-elasticsearch/15096/5 "2020-05-20T18:11:18Z")

</div>

Closed on May 20, 2020, 6:11pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.