Graylog2 / Graylog2/graylog2-server
Indexer failure uses event timestamp instead of the actual failure timestamp
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
Indexer failure should use the timestamp when the failure happens and not the timestamp of the event it tries to store.
## Current Behavior
Event timestamp is used.

## Steps to Reproduce (for bugs)
1. Setup timestamp matching for incoming logs
2. Send in a log event with timestamp in the past and which can't be indexed (e.g. use a wrong data type in field)
## Context
The failure is the interesting event that should be logged with the actual timestamp it happens. If I'm ingesting older logs the indexer failures log does not make any sense.
## Your Environment
* Graylog Version: 3.3.1 (not a new bug)
Contributor guide
Assessment
This issue has not been assessed yet.