Elasticsearch 5.4.1 Filebeat with Ingest nodes are used for grok.
In Kibana console, if we search for last 15 minutes, the query returns data which is anywhere from 5min to 5 days old. However, the @timestamp filed is for last 15 minutes only.
So it appears that the documents are indexed correctly like 5 day old line is indexed as 5 min old and there is no ordering of the document.
Is there any know issue with such ordering?