please help me!
If you want to use the timestamps from your log messages, you’ll have to use extractors or pipeline rules to extract those and set the “timestamp” field accordingly.
I mean, logs are not sorted in the order of source logs, rather than extracting timestamps.
After the log is sent to graylog, context is disorganized
That’s why you have to use an extractor or a pipeline rule to parse the timestamp in the log message and set it as “timestamp” field.
If there is no time stamp in the log? Log or erroneous sort
Please read the previous posts again, also the comments in the GitHub issue you’ve created.
Is it possible to be a performance problem？
Now is the problem of all log, millisecond error.
It’s not a timestamp error, but a log error sequence.
No. As described before, you have to parse the date string in the log message and set it as “timestamp” message field. Otherwise the ingest time of Filebeat is being used.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.