# Elapsed filter. Random messages order in pipeline

**URL:** <https://discuss.elastic.co/t/elapsed-filter-random-messages-order-in-pipeline/166158>\
**Category:** Logstash\
**Created:** [January 29, 2019, 11:46am UTC](https://discuss.elastic.co/t/elapsed-filter-random-messages-order-in-pipeline/166158 "2019-01-29T11:46:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bodi4](https://avatars.discourse-cdn.com/v4/letter/b/57b2e6/32.png) [@bodi4](https://discuss.elastic.co/u/bodi4)\
**Post date:** [January 29, 2019, 11:46am UTC](https://discuss.elastic.co/t/elapsed-filter-random-messages-order-in-pipeline/166158/1 "2019-01-29T11:46:46Z")

</div>

Bumped the problem with Elapsed filter.  
Using single pipeline worker but still...  
Trying to calculate elapsed time between 2 events from different log files on same host.  
Both events have uniqe field, correct tags, shipped with filebeat to Logstash.  
The problem is **elapsed\_end\_without\_start** , it occurs because start event is from one file and end event from another. End event processed before start event while end event has more recent timestamp.  
The cause I guess that filebeat make bulk disregarding timestamp or read time.  
Is there a way to sort messages or delay input send/read? Or there a need to modify Elapsed filter in a way to wait some time for start event?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 29, 2019, 1:29pm UTC](https://discuss.elastic.co/t/elapsed-filter-random-messages-order-in-pipeline/166158/2 "2019-01-29T13:29:07Z")

</div>

If they are in the wrong order you could use an aggregate filter instead of an elapsed filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2019, 1:29pm UTC](https://discuss.elastic.co/t/elapsed-filter-random-messages-order-in-pipeline/166158/3 "2019-02-26T13:29:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.