Log collection time error

[xutao3653 (Don Tony)]

Issue: Log collection time error

please help me!

[jochen]

If you want to use the timestamps from your log messages, you’ll have to use extractors or pipeline rules to extract those and set the “timestamp” field accordingly.

• http://docs.graylog.org/en/2.4/pages/extractors.html
• http://docs.graylog.org/en/2.4/pages/pipelines.html

[xutao3653 (Don Tony)]

I mean, logs are not sorted in the order of source logs, rather than extracting timestamps.

After the log is sent to graylog, context is disorganized

[jochen]

@xutao3653

After the log is sent to graylog, context is disorganized

That’s why you have to use an extractor or a pipeline rule to parse the timestamp in the log message and set it as “timestamp” field.

[xutao3653 (Don Tony)]

If there is no time stamp in the log? Log or erroneous sort

[jochen]

Please read the previous posts again, also the comments in the GitHub issue you’ve created.

[xutao3653 (Don Tony)]

Is it possible to be a performance problem？
80w/min

Now is the problem of all log, millisecond error.
Again reaffirms:
It’s not a timestamp error, but a log error sequence.

[jochen]

@xutao3653

Is it possible to be a performance problem？

No. As described before, you have to parse the date string in the log message and set it as “timestamp” message field. Otherwise the ingest time of Filebeat is being used.