I am running into the issue where logstash (and there by Kibana) don't know the order of events that happened on the same millisecond even though there was an initial order at the event source.
There have been discussions about this in the past:
- https://logstash.jira.com/browse/LOGSTASH-192
- http://stackoverflow.com/questions/25482663/how-to-add-sequence-id-when-using-logstash-to-parse-log
- http://stackoverflow.com/questions/23920655/include-monotonically-increasing-value-in-logstash-field
Is there any recommended best practice for solving this issue and are their plans to add something for this to logstash in the future?