# How can i maintain the sequence of log data while parsing it in logstash?

**URL:** <https://discuss.elastic.co/t/how-can-i-maintain-the-sequence-of-log-data-while-parsing-it-in-logstash/149625>\
**Category:** Logstash\
**Created:** [September 24, 2018, 6:44am UTC](https://discuss.elastic.co/t/how-can-i-maintain-the-sequence-of-log-data-while-parsing-it-in-logstash/149625 "2018-09-24T06:44:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![richagautam](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@richagautam](https://discuss.elastic.co/u/richagautam)\
**Post date:** [September 24, 2018, 6:44am UTC](https://discuss.elastic.co/t/how-can-i-maintain-the-sequence-of-log-data-while-parsing-it-in-logstash/149625/1 "2018-09-24T06:44:00Z")

</div>

Hi Team,  
How can i maintain the sequence of log data while parsing it in logstash?

My log data has a timestamp filed and some log lines have same timestamp, now while displaying data in kibana it is not coming in the order it occurs in the log file.

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 26, 2018, 4:36am UTC](https://discuss.elastic.co/t/how-can-i-maintain-the-sequence-of-log-data-while-parsing-it-in-logstash/149625/2 "2018-09-26T04:36:58Z")

</div>

Documents stored in ES have no order. You need one or more fields to sort on. If the timestamp isn't precise enough perhaps you can use some other sequence number, like the offset in the file from which the log line was read.

---

<div class="post-metadata">

**Author:** ![richagautam](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@richagautam](https://discuss.elastic.co/u/richagautam)\
**Post date:** [September 26, 2018, 5:01am UTC](https://discuss.elastic.co/t/how-can-i-maintain-the-sequence-of-log-data-while-parsing-it-in-logstash/149625/3 "2018-09-26T05:01:49Z")

</div>

How can i get offset in the file?  
I am not using filebeat, I am taking input from the file input plugin.

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 26, 2018, 6:29am UTC](https://discuss.elastic.co/t/how-can-i-maintain-the-sequence-of-log-data-while-parsing-it-in-logstash/149625/4 "2018-09-26T06:29:07Z")

</div>

Hmm, I thought the file input also provided the offset in a field. If it doesn't the easiest option would be to switch to Filebeat for your file inputs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2018, 6:36am UTC](https://discuss.elastic.co/t/how-can-i-maintain-the-sequence-of-log-data-while-parsing-it-in-logstash/149625/5 "2018-10-24T06:36:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.