So the thing is I have filebeat that ship the log file to logstash then to the elasticsearch cluster. And I created the data view the get the messages on the discover page. I wonder where this @timestamp field comes from? Is the time elasticsearch received the message? or the time logstash received …

[image] LongKang_Fan: And I use Filebeat -> Logstash -> Elasticsearch then gets the output but unordered. Did you set the number of workers to 1 ? Logstash per default will process filters and outputs in parallel and does not guarantee event order . You need to set pipeline.workers to 1 in yo…

Discuss the Elastic Stack

Is @timestamp in kibana from filebeat or logstash?

Elastic Stack Kibana

eMitch (Eddie Mitchell) March 2, 2023, 5:43pm 2

Hey @LongKang_Fan - Take a look at this answer. I believe it's still relevant.

1 Like

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.