index files not being built

[harlantjader]

after a day or so nothing shows in the dashboard if I change the time to shorter nothing shows if i change the time longer than 24 hours then data will show in the dashboard but from the day before. selecting a shorter time tells me an error that there is no index.

every day i have to restart the server to get the index files to rebuild.

i must have missed something during the install but received no errors.

can you tell me how to get the indexes to build on a schedule?

i am using the 64-bit ova

[tmcdonald]

Can you send a screenshot of the Administration -> Index Status page?
Is this for a single-node or a clustered setup?
Have you made any changes to the server?

[sreinhardt]

It sounds like the time of your sending devices may be off. Log server respects when a system claims it sent a log file. Thus if your time is off on those systems it certainly could be interpreted incorrectly. Could you post a screenshot of this happening, and a screenshot of the index status pages from Admin->Instance Status.

[harlantjader]

this is a single server built from the 64-bit ova

[harlantjader]

the server time was off by two hours. i set it to the current time.

[harlantjader]

i have attached two screen shots.

post-logstash-restart.JPG

dashboard showing before and after restarts.

index-overview.JPG

index status page after restart.

at about 14:20 i restarted the elasticsearch database.
at a bit after 14:30 i restarted the logstash collector.

thank you

[lmiltchev]

Is it possible that the logstash collector was not running? Have you had any issues after restarting it? Go to Administration->Backup & Maintenance and show us a screenshot of this page.