Many of our logs only have timestamps in the format of HH:MM:SS and therefore if more than one message is logged in the same second, they often get messed up in graylog, when ordering by timestamp. Is there any way to avoid this? It’s currently confusing people when log messages appear in a slightly wrong order.
All our logs are currently coming in via a nxlog sidecar over an TCP-GELF input.
how do you think should Graylog “know” what is the right order for the messages?
Maybe based on the order they appeared in the log file and were read by nxlog?
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.