Timestamp in ElasticSearch and Kibana

Hello.

We have an issue within our organization, with the timestamp in Kibana.
Our Orchestrator is connected to ElasticSearch and the whole view of our Robot’s run we have in Kibana.

The problem is that log messages from our Robot’s are not displaying in a correct order, as you can see on the attached screen 5 logs were performed in the same time, which of course it’s not a true. Sometimes it’s very annoying because firstly it’s saying ‘Complete get transaction data’ and after that ‘Started get transaction data’ - it should be the other way around

Do you guys have any advices, ideas what settings should we change?

Maybe it’s just a way of breaking seconds into smaller from this format HH:mm:ss.SSS ?

image

Is there multiple timestamps in the document?

Yes, multiple same timestamps. Please take a look on the screenshot, it look like 5 actions/logs has happen in the same time.

I mean, in each of those documents is there multiple fields with timestamps?

I’m not really sure what do you mean by documents? Sorry could you elaborate please

Each of those entries in your image, what you refer to as a log entry, is what is ultimately a document in Elasticsearch.

Click one of those arrows to expand the document (ie log), and post a screenshot of it.

Thank you for explanation, sure.

Ok, you've got @timestamp and timeStamp. The former is usually the default that Kibana will pick when it creates an index pattern, the latter would be something that your app is creating. But those are educated guesses at how the process works, not definite answers. If you head to Management > Settings > Index patterns, you should be able to see which is the default time field being used.

Back to your question though, you may find that there's a difference between the two timestamp fields I mentioned, and while Kibana is sorting on one, it should be using the other that you are expecting.

Checking which of those fields is the Kibana default will help clarify.

Yes it's true i can see two values of TimeStamp there, but actually for each separate document, they are still same, so that would not solve the problem if i just change them, and to be honest i don't see any differences between them. Please take a look on the screenshot.

  1. example of first doc.

  1. example of 2nd doc.

  1. view settings -> Index patterns

Ah ok then, that's good to hear!

Sounds like this goes back to your software and how it's handling the data it creates and sends to Elasticsearch. As, ultimately, Kibana can only show what is provided to it.
Have you tried speaking to the software provider?

Yes, I tried to connect with them, but nobody gave an answer, so still waiting...

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.