# Logs are not displaying in order **URL:** \ **Category:** Logstash\ **Created:** [March 29, 2017, 5:58am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409 "2017-03-29T05:58:00Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 30, 2017, 5:37am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/21 "2017-03-30T05:37:21Z")
> I have added the timestamp like below. > date{ > match =\> {"timestamp" , "ISO8601"} > } > I dont find the difference. Your events don't even have a timestamp field so the pattern doesn't matter, but let's get the multiline codec working first. ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 30, 2017, 5:37am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/22 "2017-03-30T05:37:32Z")
Confusion....😇 where i would find out the stdout output? Regards Raja ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 30, 2017, 5:38am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/23 "2017-03-30T05:38:38Z")
Cool.. As per your suggestion I have made Multiline codec but still seeing the output same. Regards Raja ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 30, 2017, 5:42am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/24 "2017-03-30T05:42:23Z")
I would recommend creating a small file that contains a few events and use this while debugging. Remove the elastic search plugin and start Logstash in the foreground. Stdout output should now appear on your screen. ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 30, 2017, 9:02am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/25 "2017-03-30T09:02:44Z")
Hi Christian, I have done fresh setup with x-pack because i pulled the elk docker image into my server. Now i am seeing the stdout logs below. [2017-03-30T09:00:28,675][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\, :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://localhost:9200/](http://localhost:9200/)'"} Even this is there i am able to see the logs in Kibana. Regards Raja ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 30, 2017, 9:47am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/26 "2017-03-30T09:47:30Z")
Please do what we ask and remove the elasticsearch output from your configuration. We only want to see the result of the `stdout { codec => rubydebug }` output. ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 30, 2017, 10:02am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/27 "2017-03-30T10:02:57Z")
Hi Magnus, Its a docker image so we have taken elkx completed container due to which it came with x-pack as well. I removed everything and made the following configuration. input { file{ path=\> "/etc/logstash/\*.log" } } filter{ } output{ stdout { codec =\> rubydebug } } Now i am seeing below error but i am able to see the logs. [2017-03-30T09:55:08,155][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2017-03-30T09:55:11,860][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://elastic:xxxxxx@localhost:9200/](http://elastic:xxxxxx@localhost:9200/), :path=\>"/"} [2017-03-30T09:55:11,990][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\, :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://localhost:9200/](http://localhost:9200/)'"} [2017-03-30T09:55:16,992][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://elastic:xxxxxx@localhost:9200/](http://elastic:xxxxxx@localhost:9200/), :path=\>"/"} [2017-03-30T09:55:17,112][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\, :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://localhost:9200/](http://localhost:9200/)'"} Regards Raja ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 30, 2017, 10:07am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/28 "2017-03-30T10:07:33Z")
You clearly haven't removed all elasticsearch outputs from your configuration. Are you pointing Logstash to a directory with configuration files? Keep in mind that Logstash reads _all_ files in that directory. ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 30, 2017, 10:13am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/29 "2017-03-30T10:13:23Z")
There is only one file i.e., POC.conf file which I have set the path in logstash.yml file ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 30, 2017, 10:18am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/30 "2017-03-30T10:18:02Z")
Well, as the error message clearly shows Logstash somehow picks up an elasticsearch output. Exactly what does your logstash.yml look like ( **format the file as preformatted text** )? What's Logstash's command line (check with e.g. `ps aux`)? ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 30, 2017, 10:25am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/31 "2017-03-30T10:25:42Z")
path.config: /etc/logstash/conf.d/Pipeline Only above property i have changed to assign the path rest all configuration commented. As i told x-pack already installed by default since it is docker container. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 30, 2017, 11:16am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/32 "2017-03-30T11:16:30Z")
So if you have /etc/logstash/conf.d/Pipeline in your logstash.yml, what's this POC.conf you're talking about? ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 31, 2017, 1:42am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/33 "2017-03-31T01:42:30Z")
The POC.conf having below. input { file{ path=\> "/etc/logstash/\*.log" } } filter{ } output{ stdout { codec =\> rubydebug } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 31, 2017, 7:04am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/34 "2017-03-31T07:04:14Z")
Yes, but what makes Logstash use your POC.conf when you're listing /etc/logstash/conf.d/Pipeline in logstash.yml? Is the latter a directory? If yes, are there any other files in that directory? And again, what's Logstash's command line? Please answer _all_ our questions. It's getting very tiresome to task the same question again and again. ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [April 3, 2017, 1:44am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/35 "2017-04-03T01:44:33Z")
what makes Logstash use your POC.conf when you're listing /etc/logstash/conf.d/Pipeline in logstash.yml? Its a conf file where it can read the configuration. are there any other files in that directory? No other files listed there. I have created only one file i.e., POC.conf. what's Logstash's command line? I am not understanding of this question. If i am not wrong i am using bash shell. Regards Raja ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 3, 2017, 5:09am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/36 "2017-04-03T05:09:51Z")
> Its a conf file where it can read the configuration. You mean it's a directory? > I am not understanding of this question. If i am not wrong i am using bash shell. Use `ps aux` and locate the Logstash process. ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [April 3, 2017, 5:13am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/37 "2017-04-03T05:13:42Z")
Yes, its a directory. -bash-4.2# ps aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 125564 4044 ? Ss Mar14 0:25 /usr/lib/system root 2 0.0 0.0 0 0 ? S Mar14 0:00 [kthreadd] root 3 0.0 0.0 0 0 ? S Mar14 0:20 [ksoftirqd/0] ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 3, 2017, 5:15am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/38 "2017-04-03T05:15:18Z")
Surely you have more processes than those three? ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [April 3, 2017, 5:18am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/39 "2017-04-03T05:18:38Z")
Yes there are near to 100 processes kibana 12220 0.3 1.0 1062980 84044 pts/1 Sl 04:27 0:08 /usr/share/kiba root 42214 0.0 0.4 877624 33464 ? Sl Mar30 0:05 nautilus --no-d root 50736 0.0 0.5 2427460 41044 ? Sl Mar21 1:08 /opt/IBM/ibm-ja root 53412 0.0 0.0 361172 3904 ? Ssl Mar30 0:00 /usr/sbin/rsysl logstash 56599 1.2 6.1 3653792 498544 ? SNsl Mar29 85:37 /usr/bin/java - elastic+ 61876 0.0 29.6 4792968 2421760 ? Ssl Mar29 6:59 /bin/java -Xms2 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 3, 2017, 5:20am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409/40 "2017-04-03T05:20:20Z")
Then please show the line for the Logstash process. PID 56599, it looks like. Show the whole line and not the truncated one above. [Previous page](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409.md?page=1) [Next page](https://discuss.elastic.co/t/logs-are-not-displaying-in-order/80409.md?page=3)