Graylog2 / Graylog2/graylog2-server

Messages in Journal do not get timestamped correctly

Open
#1,508 3 comments 0 reactions 0 assignees View on GitHub
bug P3 S2 severe triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

I had to resize and move an ES disk, and though to myself that it'd be great to try out Graylogs journal this way. Theory being that I could kill ES, do my stuff, start ES and not lose a message.

The theory was fine, 14k messages were journalized until I brought my ES back. After a few minutes, the journal queue went to 0, but now the histogram looks like this (2 hours):

![image](https://cloud.githubusercontent.com/assets/1027111/10744851/28723e7c-7c3d-11e5-8eba-ddc0366de1d6.png)

It would seem that the 14k messages that were processed, were either:
- Not processed at all
- Timestamped incorrectly (although I'm missing the 14k spike then)
- Not counted in the histogram

When searching the last 15 minutes, I get a 3.7k count (should include the 14k journaled) - so something is missing. It seems like the first option is the only one explaining this loss.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.