Timestamp in ElasticSearch and Kibana

Elastic Stack Elasticsearch
1

Hello.

We have an issue within our organization, with the timestamp in Kibana.
Our Orchestrator is connected to ElasticSearch and the whole view of our Robot’s run we have in Kibana.

The problem is that log messages from our Robot’s are not displaying in a correct order, as you can see on the attached screen 5 logs were performed in the same time, which of course it’s not a true. Sometimes it’s very annoying because firstly it’s saying ‘Complete get transaction data’ and after that ‘Started get transaction data’ - it should be the other way around

Do you guys have any advices, ideas what settings should we change?

Maybe it’s just a way of breaking seconds into smaller from this format HH:mm:ss.SSS ?

image

2

Is there multiple timestamps in the document?

4

I mean, in each of those documents is there multiple fields with timestamps?

5

I’m not really sure what do you mean by documents? Sorry could you elaborate please

6

Each of those entries in your image, what you refer to as a log entry, is what is ultimately a document in Elasticsearch.

Click one of those arrows to expand the document (ie log), and post a screenshot of it.

8

Ok, you've got @timestamp and timeStamp. The former is usually the default that Kibana will pick when it creates an index pattern, the latter would be something that your app is creating. But those are educated guesses at how the process works, not definite answers. If you head to Management > Settings > Index patterns, you should be able to see which is the default time field being used.

Back to your question though, you may find that there's a difference between the two timestamp fields I mentioned, and while Kibana is sorting on one, it should be using the other that you are expecting.

Checking which of those fields is the Kibana default will help clarify.

10

Ah ok then, that's good to hear!

Sounds like this goes back to your software and how it's handling the data it creates and sends to Elasticsearch. As, ultimately, Kibana can only show what is provided to it.
Have you tried speaking to the software provider?

11

Yes, I tried to connect with them, but nobody gave an answer, so still waiting...

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.