Graylog2 / Graylog2/graylog2-server

Populate `event_sequence` field for each Collector message

Open
#26,801 0 comments 0 reactions 0 assignees View on GitHub
collector feature
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

The `event_sequence` field can be used as secondary sort field for messages that have the same millisecond timestamp.

For files we can use the `log.file.record_number` or `log.file.record_offset`, for other sources we need to find a field. We can probably use one of the nanosecond timestamps in OTel (`Timestamp` or `ObservedTimestamp`) as a fallback.

The content team will add the `event_sequence` field with type `long` as official GIM field for 7.2.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how Collector messages are constructed and how source-specific metadata is attached. Compare file records using log.file.record_number or log.file.record_offset with other sources and the proposed OTel Timestamp or ObservedTimestamp fallback. Done means every Collector message populates event_sequence as a long, consistent with the planned GIM field.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.