Sorting events with identical millis timestamps by order events were recorded

Elastic Stack Kibana
1

Hi i have logs where multiple lines have the same timestamp. In Kibana discover they are in opposite order (if i follow the timestamp) then in the logfile, but when I check surrounding documents they are in correct order. Is it possible to see documents in discovery in correct (time based) order?

example:
logfile:

2022-02-21T13:52:15.840 [bookie-io-1-7] INFO  org.apache.bookkeeper.proto.AuthHandler - Authentication success on server side
2022-02-21T13:52:15.840 [bookie-io-1-7] INFO  org.apache.bookkeeper.proto.BookieRequestHandler - Channel connected  [id: 0x3b9d22a3, L:/10.15.24.43:3181 - R:/192.168.255.94:38216]
2022-02-21T13:52:15.840 [bookie-io-1-7] INFO  org.apache.bookkeeper.proto.BookieRequestHandler - Channels disconnected: [id: 0x3b9d22a3, L:/10.15.24.43:3181 ! R:/192.168.255.94:38216]

discover:

obrazek
obrazek1043×268 15.2 KB

surrounding docs:

obrazek
obrazek1006×275 28.6 KB

Thank you very much.

2

Hi and welcome to our community

So surrounding docs are sorting by timefield and _doc, Discover itself doesn't.

We might implement this in the future:

The only way to currently solve this is if you have an own sequence field you can sort by additionally. Or we also support sorting by a timestamp with nanoseconds

But of course most loggers don't support this

Best,
Matthias

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.