How logstash creates the @timestamp value for each record? So if I configure logstash.yml to process multiple events in batch all the events that are sampled in one batch should have same @timstamp. I have tested this, and the result confirms that understanding.
But, I have one confusion, if I configure logstash with 1 event in batch and multiple workers, can two workers set same time to their sampled events. I tried to test it, but somehow not being able to produce enough result to be sure.
How logstash creates the @timestamp value for each record?
It grabs the current time.
So if I configure logstash.yml to process multiple events in batch all the events that are sampled in one batch should have same @timstamp.
No, it won't have the same timestamp unless they happen to be processed within the same millisecond.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.