# How to parse logs in same order as in log files
**URL:** https://discuss.elastic.co/t/how-to-parse-logs-in-same-order-as-in-log-files/133982
**Category:** Kibana
**Created:** [May 31, 2018, 6:57am UTC](https://discuss.elastic.co/t/how-to-parse-logs-in-same-order-as-in-log-files/133982 "2018-05-31T06:57:17Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@yoga-sara](https://discuss.elastic.co/u/yoga-sara)
#### Post date: [May 31, 2018, 6:57am UTC](https://discuss.elastic.co/t/how-to-parse-logs-in-same-order-as-in-log-files/133982/1 "2018-05-31T06:57:17Z")
I configured my ELK setup with 1 index.It collects logs from 25 machines. The average log event count is 2.5 lacs/3 hrs. Every 5 min 5000 event parsing sometimes it increase.
My configuration like Filebeat =\> Logstash =\> Elasticsearch(single cluster with 1 node) =\> Kibana
I have event order mismatch problem.How to resolve it.
Thanks in advance.
This is my actual order of logs:
```
[[0m^[[0m04:07:34,117 INFO [com. .knowledgebase.ejb.KnowledgeBaseSingleton] (ServerService Thread Pool -- 62) 1 of 3 KnowledgeBase::26_ _UI_WF Created in serverGroup::26_ _RRFW
[[0m^[[0m04:07:36,101 INFO [com. .knowledgebase.ejb.KnowledgeBaseSingleton] (ServerService Thread Pool -- 62) 2 of 3 KnowledgeBase::26_ _FORMS Created in serverGroup::26_ _RRFW
[[0m^[[0m04:07:39,238 INFO [com. .knowledgebase.ejb.KnowledgeBaseSingleton] (ServerService Thread Pool -- 62) 3 of 3 KnowledgeBase::26_ _RATE_RRF Created in serverGroup::26_ _RRFW
```
I have attached screenshot of my misaligned logs.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 31, 2018, 8:23am UTC](https://discuss.elastic.co/t/how-to-parse-logs-in-same-order-as-in-log-files/133982/2 "2018-05-31T08:23:23Z")
You need to use the date filter in Logstash to make sure that the event timestamp is the main one in Elasticsearch.
---
### Author:  [@yoga-sara](https://discuss.elastic.co/u/yoga-sara)
#### Post date: [June 7, 2018, 10:23am UTC](https://discuss.elastic.co/t/how-to-parse-logs-in-same-order-as-in-log-files/133982/3 "2018-06-07T10:23:59Z")
Hi warkolm,
can you please give me an example?
my logs time zone is different from my access location.
My event log separated by grok filter including time.
FYR,
```
grok {
match => [
"message", "%{TIME:time} %{LOGLEVEL:level}\s+\[%{JAVACLASS:class}\] \((?[^)]+)\) %{GREEDYDATA:message}",
"message", "%{NUMBER:procsec:float} %{IP:clientip} %{DATA:logname} %{DATA:user} \[%{HTTPDATE:time}\] %{DATA:method} %{DATA:requestpath} %{DATA:httpversion} %{DATA:respstatus} %{DATA:bytesent} ((- %{GREEDYDATA:cookie})|(%{GREEDYDATA:cookie}))"
]
overwrite => ["message"]
tag_on_failure => ["JBOSSLG_grok"]
add_tag => ["JBOSSLG"]
}
```
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 7, 2018, 6:06pm UTC](https://discuss.elastic.co/t/how-to-parse-logs-in-same-order-as-in-log-files/133982/4 "2018-06-07T18:06:52Z")
Check out [https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-date.html), just make sure you set the target field to the `time` one you have groked out.
---
### Author:  [@yoga-sara](https://discuss.elastic.co/u/yoga-sara)
#### Post date: [June 8, 2018, 6:25am UTC](https://discuss.elastic.co/t/how-to-parse-logs-in-same-order-as-in-log-files/133982/5 "2018-06-08T06:25:06Z")
Hi Warkolm,
My actual problem is I am not getting events with logs time order. It shows events with kibana UI's Timestamp.
After I groked out, I used date filter with target time.
```
date {
match => ["time", "HH:mm:ss.SSS"]
target => "time"
}
```
I have attached my logs. I marked my jboss logs timestamp with red which is in mismatched order.Suggest me to resolve this or give me an example for this.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2018, 6:25am UTC](https://discuss.elastic.co/t/how-to-parse-logs-in-same-order-as-in-log-files/133982/6 "2018-07-06T06:25:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.