By chance do you have other streams branching off the " All Message" Stream? If so, was the tic box enabled to removed duplicates?
Form what I have seen, its best to manipulate Timestamp from Graylog then try to force Graylog to use a specific timestamp configuration.
Is it possible to show a screen shot of this issue? If so you know the routine.
Not sure if this will help but here are a couple examples I have in my arsenal.
rule "add pipeline_processingtime"
let ingestion_time = to_date($message.input_time).millis;
let current_time = to_date(now()).millis;
let millis_diff = to_long(to_long(current_time) - to_long(ingestion_time));
rule "add ingestion timestamp"
let ingestion_time = now();
let timestamp_time = parse_date(to_string($message.timestamp), "yyyy-MM-dd'T'HH:mm:ss.SSSZ");
If a extractor is create you could use the Date modifier.
Looking at the stated doc for time formatting here there is no format relatable to ffffff (FN Time!)
It appears the best you can do is milliseconds: SSS
You can either submit a bug/feature into Graylog which will take some time (but definitely not fff or SSS time) or since you mentioned the developers made changes to accommodate, maybe they can make a separate differentiator or incrementor on their side…
It could also be that the log shipping is happening in batches and getting assigned their time at that time… Do you really have timestamp where there is no difference in the hundreds of milliseconds? (yow!)
It’s not clear though, what you are actually seeing coming through - can you show an example message?