I have the following setup to gather data : filebeat -> logstash -> elastichsearch
As input I have files with the following plain text format :
2017-07-25 10:36:07,988 21 User 1 Ligne 0
2017-07-25 10:36:07,988 21 User 1 Ligne 1
2017-07-25 10:36:07,988 21 none 1 Ligne 2
once the file is harvested by filebeat it goes thru logstash where I map @timestamp field. but when I query Elasticsearch I get different order than the one the source log file. (log2, log 0, log 1 instead of log 0, log 1, log 2 )
the timestamp field in not precise enough I will always get more than 1 doc for the same exact timestamp.
How can I solve this issue ? I would like to be able to get document in elasticsearch in the same order as their are in the log file.