Hi Jochen, I must have missed that part in IRC, so sorry!! But thank you for pointing me in the right direction - Ill definetly have a look at our time stamps. It just might be that rsyslog reformats our timestamps.
So I wonder if I can just override all incoming timestamps for each and any message to the ime the message was received. Cheers again!! On Jan 19, 2017 4:46 PM, "Jochen Schalanda" <[email protected]> wrote: > Hi Jerri, > > On Thursday, 19 January 2017 16:05:52 UTC+1, Jerri Son wrote: >> >> More specifically it doesn´t matter how small the time frame was in my >> case - as soon >> as I used "quick values" on any number of message (in my case 18 message, >> timespan 10 seconds) I made graylog/ES crash with messages like >> "Unhandled exception in REST resource" and garabace-collector messages in >> ES. >> > > We already found out in IRC that there are some messages with strange > timestamps in your indices which lead to the problem that the time range of > all indices are overlapping which in turn means Graylog will always query > all indices, no matter how big or small your selected time frame is. > > >> Seeing as Graylog 2.0 and maybe graylog 2.1 is still affected, I really >> wonder if 2.2 will solve this issue - if it is solveable at all! >> > > No, Graylog 2.2.x will not solve the issue of corrupt message time stamps. > > Cheers, > Jochen > > -- > You received this message because you are subscribed to a topic in the > Google Groups "Graylog Users" group. > To unsubscribe from this topic, visit https://groups.google.com/d/ > topic/graylog2/e_D9Bf15E5s/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > [email protected]. > To view this discussion on the web visit https://groups.google.com/d/ > msgid/graylog2/5cfa3c84-4019-4b31-ba60-2d4b8035d556%40googlegroups.com > <https://groups.google.com/d/msgid/graylog2/5cfa3c84-4019-4b31-ba60-2d4b8035d556%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/CAAPTZjyhbV4R_rGFVqjC%2BUEaUQrzAUcye4J4rhcfak58TEiwCQ%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
