Elapsed Plugin Negative elapsed_time

Elastic Stack Logstash
1

There are no unique ids in my logs so i'm creating my own by adding multiple fields but the thing is that they may repeat over time.

My LOC #1457(END Tag) is matching with #1559 (START Tag) instead of #1450(START Tag).
#1450(Start Tag) is matching with #1556(END Tag) instead of #1457(END Tag).
It is also very non-deterministic in this when i run it multiple times with same logs.

I believe its not reading the logs in a serialized manner otherwise this problem would never happen. My input config :-

input {
file {
path => "/home/vsharma/Documents/logstash-5.1.2/bin/varun1.log"
}
}

Any way to get it logstash to go through my logs sequentially? Example :- line 1, line 2, 3....
Edit:
Seems like logstash is sequential but threads in elapsed plugin are not. Any suggestion?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.