hi, it seems, it was working all the time .. but I did not saw it, because on VictoriaLogs the entries started, when fluent-bit pushes the logs .. but I've expected not the hole in between. Then I've checked it more closely and I see, that the received !=event created . So I'm asking me .. is the issue on VL or my fluent-bit config? As example:

"_date": "2026-03-17T14:47:17.000Z",
    "_facility_text": "security",
    "_level_text": "info",
    "_msg": "[login:dfuchs ssh:((undefined)) sid:2535852 tty:/dev/pts/0 (1024/dfuchs) uid:root(0)/root(0) cwd:/root]: sleep 10",
    "_stream": "{}",
    "_stream_id": "0000000000000000e934a84adb05276890d7f7bfcadabe92",
    "_time": "2026-03-17T14:48:10.345887978Z",
    "date": "2026-03-17T15:47:17.000000Z",

So in VictoriaLogs I have a whole with 1min.

I am using "/insert/jsonline?_msg_field=log&_time_field=date""

It worked !

sorry .. what works? 😛