# Logs with the same timestamp wrong located

**URL:** <https://discuss.elastic.co/t/logs-with-the-same-timestamp-wrong-located/311207>\
**Category:** Logstash\
**Created:** [August 2, 2022, 11:25am UTC](https://discuss.elastic.co/t/logs-with-the-same-timestamp-wrong-located/311207 "2022-08-02T11:25:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TaiNguyen](https://avatars.discourse-cdn.com/v4/letter/t/59ef9b/32.png) [@TaiNguyen](https://discuss.elastic.co/u/TaiNguyen)\
**Post date:** [August 2, 2022, 11:25am UTC](https://discuss.elastic.co/t/logs-with-the-same-timestamp-wrong-located/311207/1 "2022-08-02T11:25:28Z")

</div>

Hello!  
Im using logstash version 7.10.3. Below is my logstash filter config for timstamp match

```auto
filter {
        if ([biz] and [log][type] != "nginx") {

                grok {
                        match => { "message" => "^\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:env}\.%{DATA:severity}: .*" }
                }

                date {
                        match => ["[timestamp]", "yyyy-MM-dd HH:mm:ss" ]
                        remove_field => "[timestamp]"
                }
        }
}

```

It works fine with regular log but with some data have the same timestamp. It just miss located  
Ex:

```auto
[2022-08-02 17:37:32] 4 [] []
[2022-08-02 17:37:32] 5 [] []
[2022-08-02 17:37:32] 6 [] []
[2022-08-02 17:37:32] 12 [] []
[2022-08-02 17:37:32] 13 [] []
[2022-08-02 17:37:32] 14 [] []
[2022-08-02 17:37:32] 15 [] []
[2022-08-02 17:37:32] 16 [] []
[2022-08-02 17:37:32] 18 [] []
[2022-08-02 17:37:32] 19 [] []
[2022-08-02 17:37:32] 20 [] []
[2022-08-02 17:37:32] 21 [] []
[2022-08-02 17:37:32] 22 [] []
[2022-08-02 17:37:32] 23 [] []
[2022-08-02 17:37:32] 25 [] []
[2022-08-02 17:37:32] 26 [] []
[2022-08-02 17:37:32] 27 [] []
[2022-08-02 17:37:32] 28 [] []
[2022-08-02 17:37:32] 29 [] []
[2022-08-02 17:37:32] 30 [] []
[2022-08-02 17:37:32] 32 [] []
[2022-08-02 17:37:32] 39 [] []
[2022-08-02 17:37:32] 40 [] []
[2022-08-02 17:37:32] 41 [] []
[2022-08-02 17:37:32] 42 [] []
[2022-08-02 17:37:32] 43 [] []
[2022-08-02 17:37:32] 44 [] []
[2022-08-02 17:37:32] 45 [] []
[2022-08-02 17:37:32] 46 [] []
[2022-08-02 17:37:32] 47 [] []
[2022-08-02 17:37:32] 48 [] []
[2022-08-02 17:37:32] 49 [] []
[2022-08-02 17:37:32] 50 [] []
[2022-08-02 17:37:32] 51 [] []
[2022-08-02 17:37:32] 52 [] []
[2022-08-02 17:37:32] 53 [] []
[2022-08-02 17:37:32] 54 [] []
[2022-08-02 17:37:32] 55 [] []
[2022-08-02 17:37:32] 56 [] []
[2022-08-02 17:37:32] 57 [] []
[2022-08-02 17:37:32] 59 [] []
[2022-08-02 17:37:32] 61 [] []
[2022-08-02 17:37:32] 63 [] []
[2022-08-02 17:37:32] 66 [] []
[2022-08-02 17:37:32] 68 [] []
[2022-08-02 17:37:32] 69 [] []
[2022-08-02 17:37:32] 70 [] []

```

On Kibana:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/d/cda73109660bc1d7fe1afa5a419f74ce325118ec.png)

Thank for reading!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2022, 11:26am UTC](https://discuss.elastic.co/t/logs-with-the-same-timestamp-wrong-located/311207/2 "2022-08-30T11:26:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.