# Logs appear out of order when burst logging is done

**URL:** <https://discuss.elastic.co/t/logs-appear-out-of-order-when-burst-logging-is-done/98843>\
**Category:** Elasticsearch\
**Created:** [August 30, 2017, 11:08am UTC](https://discuss.elastic.co/t/logs-appear-out-of-order-when-burst-logging-is-done/98843 "2017-08-30T11:08:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sbsatter](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@sbsatter](https://discuss.elastic.co/u/sbsatter)\
**Post date:** [August 30, 2017, 11:08am UTC](https://discuss.elastic.co/t/logs-appear-out-of-order-when-burst-logging-is-done/98843/1 "2017-08-30T11:08:33Z")

</div>

When the logs appear to have the same timestamps, some of it appears out of order. Reading through some of the topics, I couldn't find a suitable solution. But I believe there must be something done about it since this issue was reported as early as Logstash 1.

Basically, I am using logstash to listen on a certain port for incoming tcp using the json lines codec [using the l[ogstash-logback-encoder](https://github.com/logstash/logstash-logback-encoder) here]. For now, the filter is empty and I'm outputting the data to elasticsearch and stdout (codec rubydebug).

The console log in my IDE:  
2017-Aug-30 15:15:30.191 [main] INFO com.sbsatter.logbackLogstash.App - Testing LOG Order;  
Expected Order: 1 =\> 10  
2017-Aug-30 15:15:30.193 [main] INFO com.sbsatter.logbackLogstash.App - 1  
2017-Aug-30 15:15:30.194 [main] INFO com.sbsatter.logbackLogstash.App - 2  
...  
2017-Aug-30 15:15:30.195 [main] INFO com.sbsatter.logbackLogstash.App - 9  
2017-Aug-30 15:15:30.195 [main] INFO com.sbsatter.logbackLogstash.App - 10

The terminal which launched logstash reads accordingly:  
{  
"@timestamp" =\> 2017-08-30T09:15:30.197Z,  
"port" =\> 47820,  
"@version" =\> "1",  
"host" =\> "127.0.0.1",  
"time" =\> "2017-08-30 15:15:30.191+0600",  
"message" =\> "Testing LOG Order;\nExpected Order: 1 =\> 10"  
}  
{  
"@timestamp" =\> 2017-08-30T09:15:30.198Z,  
"port" =\> 47820,  
"@version" =\> "1",  
"host" =\> "127.0.0.1",  
"time" =\> "2017-08-30 15:15:30.193+0600",  
"message" =\> "1"  
}  
{  
"@timestamp" =\> 2017-08-30T09:15:30.198Z,  
"port" =\> 47820,  
"@version" =\> "1",  
"host" =\> "127.0.0.1",  
"time" =\> "2017-08-30 15:15:30.194+0600",  
"message" =\> "2"  
}  
.....  
{  
"@timestamp" =\> 2017-08-30T09:15:30.216Z,  
"port" =\> 47820,  
"@version" =\> "1",  
"host" =\> "127.0.0.1",  
"time" =\> "2017-08-30 15:15:30.195+0600",  
"message" =\> "9"  
}  
{  
"@timestamp" =\> 2017-08-30T09:15:30.224Z,  
"port" =\> 47820,  
"@version" =\> "1",  
"host" =\> "127.0.0.1",  
"time" =\> "2017-08-30 15:15:30.195+0600",  
"message" =\> "10"  
}

BUT, kibana shows the following ☹ :  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c42de900726f98d7a26778d9cb614f5ded72cbb7.png)

While the difference is not great in here, however, when used with real-time logs, changed order makes the log appear nonsense. How can I fix this issue?  
P.S. This has also been added in [Stack Overflow](https://stackoverflow.com/questions/45959009/logs-appear-out-of-order-when-burst-logging-is-done), but I've had no luck over there [as of] yet.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2017, 11:09am UTC](https://discuss.elastic.co/t/logs-appear-out-of-order-when-burst-logging-is-done/98843/2 "2017-09-27T11:09:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.