Bug：log context has two bugs

[worker24h]

bug1: the order of log context is not same with the raw logs and missed some logs， as follow：

bug2: Setting oldest first for log context plugin, the panel doesn't show before data, as follow

[hagen1778]

@Loori-R @dmitryk-dk could you please take a look?

[Loori-R]

The _time field on the left is correctly ordered. The highlighted timestamps are part of the log message itself. They can appear out of order due to asynchronous log generation, network delays, or clock drift between servers. For accurate analysis, it’s better to rely on _time.

[Loori-R]

@worker24h, Thanks for the screenshots.

We tested this on Grafana 11.3.1 and 12.0.1, and everything works as expected when using "Oldest first" order.

Could you please clarify:

• What Grafana version are you using?
• Can you share the query and mention if any additional filters were applied?
• Are you sure there should be older log entries? It’s possible there are none in this context.

[arturminchukov]

Issue #379 can be related to bug2. @worker24h could you check if the problem is still exists?

[mladedav]

I'm also running into the oldest first logs not being shown. I'm on grafana 11.5.2.

To be clear, the logs are ordered correctly, but if I have a stream with 100 logs per minute and a query with timerange of 00:00-01:00 and a limit of 1000 logs, I get just logs from 00:50-01:00 in both cases with the only difference being ordering. The expected behavior with oldest first would be to get logs in the range 00:00-00:10`.

I'm currently on VL datasource plugin 0.19.2 so I'll try upgrading first but I didn't see anything in the changelog mentioning this.

[arturminchukov]

I'm also running into the oldest first logs not being shown. I'm on grafana 11.5.2.

To be clear, the logs are ordered correctly, but if I have a stream with 100 logs per minute and a query with timerange of 00:00-01:00 and a limit of 1000 logs, I get just logs from 00:50-01:00 in both cases with the only difference being ordering. The expected behavior with oldest first would be to get logs in the range 00:00-00:10`.

I'm currently on VL datasource plugin 0.19.2 so I'll try upgrading first but I didn't see anything in the changelog mentioning this.

Got it. Right now, we cannot get access to the panel settings where you set the sorting (desc | asc). This is necessary to automatically add a sort pipe to the end of the query based on the sort setting in the panel. So the workaround right now is to add a sorting pipe manually to the end of the query: sort by (_time) <desc|asc>. Panel settings order the logs that were already loaded. So now, this issue is not working as expected.

[mladedav]

When doing Loki queries, the information is sent as a direction field but I don't know if they have it somehow special-cased (I hope not). If I get some time, I'll try to look if I can find some kind of setting enabling this, unless you know that that wouldn't work for some reason?

Loki query

{
  "queries": [
    {
      "refId": "A",
      "expr": "{...}",
      "queryType": "range",
      "key": "Q-b0ac343a-4c3d-46e3-87e6-4ccab4c6428f-0",
      "datasource": {
        "type": "loki",
        "uid": "..."
      },
      "editorMode": "code",
      "direction": "forward",
      "maxLines": 200,
      "step": "",
      "legendFormat": "",
      "datasourceId": 292,
      "intervalMs": 1000,
      "maxDataPoints": 2559
    }
  ],
  "from": "1765270164475",
  "to": "1765273764476"
}

Victoria Logs query

{
  "queries": [
    {
      "refId": "A",
      "datasource": {
        "type": "victoriametrics-logs-datasource",
        "uid": "..."
      },
      "editorMode": "code",
      "expr": "{service_name=\"etcd\", streaming_stack=\"global1\"}",
      "queryType": "instant",
      "maxLines": 1000,
      "legendFormat": "",
      "datasourceId": 263,
      "intervalMs": 1000,
      "maxDataPoints": 2559
    }
  ],
  "from": "1765270121547",
  "to": "1765273721547"
}