# Order of logs with same timestamp

**URL:** https://discuss.elastic.co/t/order-of-logs-with-same-timestamp/28577
**Category:** Logstash
**Created:** [September 3, 2015, 4:18am UTC](https://discuss.elastic.co/t/order-of-logs-with-same-timestamp/28577 "2015-09-03T04:18:20Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![JW1](https://avatars.discourse-cdn.com/v4/letter/j/34f0e0/32.png) [@JW1](https://discuss.elastic.co/u/JW1)
#### Post date: [September 3, 2015, 4:18am UTC](https://discuss.elastic.co/t/order-of-logs-with-same-timestamp/28577/1 "2015-09-03T04:18:20Z")

</div>

I'm using logstash to parse my application's log files. Sometimes several events happen at the same time, at least according to their timestamp. But I'd like to be able to see them in their original order in Kibana. Is there a way to make this happen, maybe by recording some kind of sequence number?

I'm using log-courier to forward my logs to a logstash server, if that matters.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 3, 2015, 4:40am UTC](https://discuss.elastic.co/t/order-of-logs-with-same-timestamp/28577/2 "2015-09-03T04:40:05Z")

</div>

How do you know that their original order is though?

---

<div class="post-metadata">

### Author: ![JW1](https://avatars.discourse-cdn.com/v4/letter/j/34f0e0/32.png) [@JW1](https://discuss.elastic.co/u/JW1)
#### Post date: [September 3, 2015, 5:03am UTC](https://discuss.elastic.co/t/order-of-logs-with-same-timestamp/28577/3 "2015-09-03T05:03:13Z")

</div>

The program reading the original log files would know, so I guess it would have to come from there. That might make this a question for log-courier, but if there's a solution using logstash-forwarder, I'd be open to using that instead.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 3, 2015, 5:17am UTC](https://discuss.elastic.co/t/order-of-logs-with-same-timestamp/28577/4 "2015-09-03T05:17:06Z")

</div>

LSF does and doesn't have this concept.  
It does because of sincedb, so if it reads event 1 and has to stop, it'll pickup at event 2. But there is no way to pass that this was event 1 at timestamp N through.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/order-of-logs-with-same-timestamp/28577/5 "2017-07-06T05:30:18Z")

</div>


