FAQ: Errors are raised when data is ingested with Timestamps in the Future

When ingesting data that has a timestamp in the future, LogScale will:

  • Overwrite the @timestamp with the ingest timestamp

  • Raise an error in the log during ingestion to highlight the change.

The most common reason for this happening is when ingesting data from a log shipper that is in a different timezone, which is submitting timestamps set to the local timezone.

The recommended solution is to ensure that timestamp information is being generated and any timestamps are supplied in the UTC timezone.

LogScale supports @timestamp values that are up to 10 seconds ahead of @ingesttimestamp.

This behaviour does not affect timestamps that are not parsed into the @timestamp field.