Timestamp issue, nanoseconds needed for correct ordering

[pditmar2]

I have an issue with the timestamp of ingested logs. Dynatrace cuts out the nanoseconds, which in some cases make two events appear to be in the wrong order. This messes up my Business Flows. The actual timestamp that I would like to use, including nanoseconds, is available in the logs. At the arrow, you can see the record that is in the wrong order. In the screenshots you can see the "started" is listed after the "finished" because the nanoseconds get cut off.

Is there any way I can add the nanoseconds to the timestamp that is used by Dynatrace for ordering the logs (and for the business events).

[MaciejNeumann]

Hi @pditmar2,

In our internal resources, I've found a workaround, that could potentially solve your use case. Let us know if this helps:

It looks like the issue may be related to how microseconds are being parsed and stored in Grail. By default, sorting on the timestamp field only goes down to the millisecond level, which can cause logs with identical timestamps to appear out of the expected order. As a workaround, you can enhance your sort logic by adding the ordinal field alongside timestamp. The ordinal reflects the order in which logs were ingested into Grail, which typically aligns with how they were emitted by the application. Here’s an updated query you can use:

fetch logs
| filter matchesValue(status, { "INFO", "WARN", "ERROR" }) AND matchesValue(k8s.namespace.name, "namespace-name")
| sort timestamp, ordinal desc