Found 2016-11-02 Log

[pccwglobalit]

we found there are some log date is not correct. How can we found where it comes from?

[jolson]

Which dates were not correct? There was a rollover bug during the new year that caused data to fall into January 1st of 2015 until Logstash was restarted (an Apply Config would do this for you).

Otherwise, it could be that some of your clients have an incorrect date set on them. In either case, I would take a look at the logs and either:

1. Delete the index if it's not relevant.

2. Correct the time on your remote host.

Thanks!