Graylog2 / Graylog2/graylog2-server

Indexer failure uses event timestamp instead of the actual failure timestamp

Open
#8,903 1 comment 2 reactions 1 assignee Claimed by @dennisoelkers View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

Indexer failure should use the timestamp when the failure happens and not the timestamp of the event it tries to store.

## Current Behavior

Event timestamp is used.

![Screenshot 2020-09-01 at 12 49 15](https://user-images.githubusercontent.com/24830359/91836560-9daca700-ec53-11ea-8311-3d837c9ba7b4.png)

## Steps to Reproduce (for bugs)

1. Setup timestamp matching for incoming logs
2. Send in a log event with timestamp in the past and which can't be indexed (e.g. use a wrong data type in field)

## Context

The failure is the interesting event that should be logged with the actual timestamp it happens. If I'm ingesting older logs the indexer failures log does not make any sense.

## Your Environment

* Graylog Version: 3.3.1 (not a new bug)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.