search

Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.37k stars 1.06k forks source link

Indexer failure uses event timestamp instead of the actual failure timestamp #8903

Open hulkk opened 4 years ago

hulkk commented 4 years ago

Expected Behavior

Indexer failure should use the timestamp when the failure happens and not the timestamp of the event it tries to store.

Current Behavior

Event timestamp is used.

Screenshot 2020-09-01 at 12 49 15

Steps to Reproduce (for bugs)

  1. Setup timestamp matching for incoming logs
  2. Send in a log event with timestamp in the past and which can't be indexed (e.g. use a wrong data type in field)

Context

The failure is the interesting event that should be logged with the actual timestamp it happens. If I'm ingesting older logs the indexer failures log does not make any sense.

Your Environment

hulkk commented 3 years ago

Any updates?