Graylog2 / Graylog2/graylog2-server
Populate `event_sequence` field for each Collector message
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
The `event_sequence` field can be used as secondary sort field for messages that have the same millisecond timestamp.
For files we can use the `log.file.record_number` or `log.file.record_offset`, for other sources we need to find a field. We can probably use one of the nanosecond timestamps in OTel (`Timestamp` or `ObservedTimestamp`) as a fallback.
The content team will add the `event_sequence` field with type `long` as official GIM field for 7.2.
Contributor guide
Research direction
Start by tracing how Collector messages are constructed and how source-specific metadata is attached. Compare file records using log.file.record_number or log.file.record_offset with other sources and the proposed OTel Timestamp or ObservedTimestamp fallback. Done means every Collector message populates event_sequence as a long, consistent with the planned GIM field.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 38/100