In-correct document index order

Elastic Stack Elasticsearch
1

Elasticsearch 5.4.1 Filebeat with Ingest nodes are used for grok.

Problem noticed:

In Kibana console, if we search for last 15 minutes, the query returns data which is anywhere from 5min to 5 days old. However, the @timestamp filed is for last 15 minutes only.
So it appears that the documents are indexed correctly like 5 day old line is indexed as 5 min old and there is no ordering of the document.

Is there any know issue with such ordering?

2

Are you using a date processor to update the @timestamp to the correct one in the event?

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.