据我所知，你有两个选择：
提高时间戳精度（就像你做的那样）；或
使用日志存储，可以维护数据的顺序。例如mongodb。日志收集的概念在另一篇stackoverflow文章中描述。

我在这个答案中找到了一个fluentd的解决方案，尽管我仍然想要一个真正的解决方案
这是我修改的td-agent.conf，用于fluentd es图像。它增加了 time_nano 字段，可按其排序

<source>
  type tail
  format json
  time_key time
  path /varlog/containers/*.log
  pos_file /varlog/es-containers.log.pos
  time_format %Y-%m-%dT%H:%M:%S.%L%Z
  tag cleanup.reform.*
  read_from_head true
</source>

<match cleanup.**>
   type record_reformer
   time_nano ${t = Time.now; ((t.to_i * 1000000000) + t.nsec).to_s}
   tag ${tag_suffix[1]}
</match>

<match reform.**>
  type record_reformer
  enable_ruby true
  tag kubernetes.${tag_suffix[3].split('-')[0..-2].join('-')}
</match>

<match kubernetes.**>
   type elasticsearch
   log_level info
   include_tag_key true
   host elasticsearch-logging.default
   port 9200
   logstash_format true
   flush_interval 5s
   # Never wait longer than 5 minutes between retries.
   max_retry_wait 300
   # Disable the limit on the number of retries (retry forever).
   disable_retry_limit
</match>

<source>
  type tail
  format none
  path /varlog/kubelet.log
  pos_file /varlog/es-kubelet.log.pos
  tag kubelet
</source>

<match kubelet>
   type elasticsearch
   log_level info
   include_tag_key true
   host elasticsearch-logging.default
   port 9200
   logstash_format true
   flush_interval 5s
   # Never wait longer than 5 minutes between retries.
   max_retry_wait 300
   # Disable the limit on the number of retries (retry forever).
   disable_retry_limit
</match>