Date interpreting problem double time line given in one message

[fribse (Kenneth Fribert)]

Hi Guys and Gals

We have a messy logfile, that I'm working my way through.
Most of it is now correct, but for some reason I have an issue if the logfile contains two entries on top of each other.

Normally an entry looks like this:

Exception: Access violation at address 02F6621D in module 'MHDIAL~1.DLL'. Read of address 00000010
Time: 11/26/2018 9:08:15 AM
Module: C:\PROGRA~2\PST\MILLIO~1\DIALOG~1\MHDIAL~1.DLL
Version: 6.0.0.267
Filedate: 6/4/2013 8:24:02 AM
Instancename: YANKEE
Username: internal
ProcessID: 6808
ThreadID: 5280
Exceptiontype: EAccessViolation
Unit: 
Procedure: Xml.XMLSchema.FindItemNS
Line: 0
SQLStatement: 

[02F6621D] Xml.XMLSchema.FindItemNS
[02F662F9] Xml.XMLSchema.TXMLSchemaItems.FindItem
[02F666AA] Xml.XMLSchema.TXMLSimpleTypeDefs.Find
[02F69BFA] Xml.XMLSchema.TXMLSchemaDef.PrefixedTypeName
[02F63686] Xml.XMLSchema.TXMLTypedSchemaItem.SetDataTypeName
[02F6768C] Xml.XMLSchema.TXMLElementDefs.Add
[03007405] MHXMLDatasetUtils.RecursivelyAddDatasets (Line 157, "MHXMLDatasetUtils.pas")
[030075E0] MHXMLDatasetUtils.TMHXMLDatasetUtils.DoBuildXMLSchemaFromDataset (Line 180, "MHXMLDatasetUtils.pas")
[03006D99] MHXMLDatasetUtils.TMHXMLDatasetUtils.BuildXMLFromDataset (Line 80, "MHXMLDatasetUtils.pas")
[0300AE83] MHDataAccessLayer.TMHCustomDataAccessLayer.BuildXMLFromDataset (Line 36, "MHDataAccessLayer.pas")
[03BDAC34] MHWebUtilsAPI.TMHWebUtilsAPI.GetWebPublicFile (Line 192, "MHWebUtilsAPI.pas")
--------------------------------------------------------------------------------

But due to the programmers are writing directly to the logfile, and not to a queue, it sometimes write two entries on top of each other, like this:

Exception: Access violation at address 0000006C. Write of address 0000006C
Time: 6/29/2018 8:47:16 PM
Module: C:\Windows\SysWOW64\dllhst3g.exe
Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Filedate: 7/14/2009 3:14:18 AM
Instancename: YANKEE
Username: internal
ProcessID: 6440
ThreadID: 6772
Exceptiontype: EAccessViolation
Unit: 
Procedure: 
Line: 0
SQLStatement: 


Exception: Access violation at address 02D93BC9 in module 'MHDIAL~1.DLL'. Write of address 02DDE1F4
Time: 6/29/2018 8:47:16 PM
Module: C:\PROGRA~2\PST\MILLIO~1\DIALOG~1\MHDIAL~1.DLL
Version: 6.0.0.267
Filedate: 6/4/2013 9:24:02 AM
Instancename: YANKEE
Username: internal
ProcessID: 6440
ThreadID: 4904
Exceptiontype: EAccessViolation
Unit: 
Procedure: System.SysFreeMem
Line: 0
SQLStatement: 

[02D93BC9] System.SysFreeMem
[02D975E8] System.TObject.Free
[03191130] MHWebUtilsAccessLayer.TMHWebUtilsAccessLayer.GetWebPublicFileAsDataset (Line 642, "MHWebUtilsAccessLayer.pas")
[031912AA] MHWebUtilsAccessLayer.TMHWebUtilsAccessLayer.GetWebPublicFileXML (Line 659, "MHWebUtilsAccessLayer.pas")
[03C6AC34] MHWebUtilsAPI.TMHWebUtilsAPI.GetWebPublicFile (Line 192, "MHWebUtilsAPI.

I've written a date match that should handle the timeformats I see:

    date {
            match => [ "Time", "MM/dd/yyyy HH:mm:ss aa", "M/d/yyyy HH:mm:ss aa", "M/d/yyyy H:m:ss aa", "dd-MM-yyyy HH:mm:ss", "d-M-yyyy HH:mm:ss", "MM/dd/yyyy", "M/d/yyyy", "dd-MM-yyyy", "d-M-yyyy" ]
            timezone => "Europe/Copenhagen"
    }

And it works unless two entries are written 'on top' of each other, why???