Hello,
at the moment i am trying to migrate to graylog from very basic textfiles where i am currently logging my agents.
The problem is that i am used to having all my log entries in order and since my agents are quite fast at logging there are multiple log entries for the same timestamp.
Since graylog uses the timestamp to order my messages, the messages that have the same timestamp will now be shown in random order which is confusing.
There are two possible problems here. First, the agent you are using may be collecting these messages then delivering them in a different order than that in the original file. If that’s the case, there’s not much Graylog can do for you, because that’s the order in which they are arriving.
However, if the agent is delivering them in the same order they are read, the trouble may lie in Graylog itself. At least your version of Graylog.
In version 5.1, we fixed the exact issue you are experiencing by adding a ULID for each message received. This allows for sorting by ULID, even when the timestamps are identical.
You need only to upgrade and it will be resolved. That is, provided your agent is delivering them as read.
