Log collection time error

(Don Tony) #1

please help me!

(Jochen) #2

If you want to use the timestamps from your log messages, you’ll have to use extractors or pipeline rules to extract those and set the “timestamp” field accordingly.

(Don Tony) #3

I mean, logs are not sorted in the order of source logs, rather than extracting timestamps.

After the log is sent to graylog, context is disorganized

(Jochen) #4

That’s why you have to use an extractor or a pipeline rule to parse the timestamp in the log message and set it as “timestamp” field.

(Don Tony) #5

If there is no time stamp in the log? Log or erroneous sorttesteeee

(Jochen) #6

Please read the previous posts again, also the comments in the GitHub issue you’ve created.

(Don Tony) #7

Is it possible to be a performance problem?

Now is the problem of all log, millisecond error.
Again reaffirms:
It’s not a timestamp error, but a log error sequence.

(Jochen) #8

No. As described before, you have to parse the date string in the log message and set it as “timestamp” message field. Otherwise the ingest time of Filebeat is being used.

(system) #9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.