# How to keep my entries ordered as in my file

**URL:** <https://discuss.elastic.co/t/how-to-keep-my-entries-ordered-as-in-my-file/133226>\
**Category:** Logstash\
**Created:** [May 24, 2018, 9:55pm UTC](https://discuss.elastic.co/t/how-to-keep-my-entries-ordered-as-in-my-file/133226 "2018-05-24T21:55:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![czem](https://avatars.discourse-cdn.com/v4/letter/c/b487fb/32.png) [@czem](https://discuss.elastic.co/u/czem)\
**Post date:** [May 24, 2018, 9:55pm UTC](https://discuss.elastic.co/t/how-to-keep-my-entries-ordered-as-in-my-file/133226/1 "2018-05-24T21:55:41Z")

</div>

I'm ingesting a log file with Filebeat and sending to my ElasticSearch through Logstash. My log file has the following pattern:

```auto
Timestamp - TransactionId - Header (Username)
Timestamp - TransactionId - Events (This line may repeat multiple times)
Timestamp - TransactionId - Footer

```

The timestamp doesn't include milliseconds and sometimes the timestamp may repeat for the same transaction. I would like to make sure the order I see in Kibana is the same as in the file.

Today I use Aggregate to distribute fields I have in my header to all log entries. I've tried to create a field called "milliseconds" in the aggregation and increment it for each subsequent line that got matched. My intention was to add this field to the timestamp latter.

```auto
if [sync_type] == "start"
{
	aggregate {
		task_id => "%{transaction_id}"
		code => "
			map['milliseconds'] = 0
		"
		map_action => "create"
	}
}
else if [sync_type] == "end"
{
	aggregate {
		task_id => "%{transaction_id}"
		code => "
			event.set('milliseconds', map['milliseconds'] + 1)
		"
		map_action => "update"
		end_of_task => true
		timeout => 120
	}
}
else
{
	aggregate {
		task_id => "%{transaction_id}"
		code => "
			event.set('milliseconds', map['milliseconds'] + 1)
		"
		map_action => "update"
	}
}

```

It didn't work... every line remains with the fields "milliseconds" as 1.

Any idea of how I can make this work?

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2018, 9:55pm UTC](https://discuss.elastic.co/t/how-to-keep-my-entries-ordered-as-in-my-file/133226/2 "2018-06-21T21:55:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.