Log collection time error

(Don Tony) #1

please help me!

(Jochen) #2

If you want to use the timestamps from your log messages, you’ll have to use extractors or pipeline rules to extract those and set the “timestamp” field accordingly.

(Don Tony) #3

I mean, logs are not sorted in the order of source logs, rather than extracting timestamps.

After the log is sent to graylog, context is disorganized

(Jochen) #4

That’s why you have to use an extractor or a pipeline rule to parse the timestamp in the log message and set it as “timestamp” field.

(Don Tony) #5

If there is no time stamp in the log? Log or erroneous sorttesteeee

(Jochen) #6

Please read the previous posts again, also the comments in the GitHub issue you’ve created.

(Don Tony) #7

Is it possible to be a performance problem?

Now is the problem of all log, millisecond error.
Again reaffirms:
It’s not a timestamp error, but a log error sequence.

(Jochen) #8

No. As described before, you have to parse the date string in the log message and set it as “timestamp” message field. Otherwise the ingest time of Filebeat is being used.

(system) closed #9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.