Elapsed Plugin Negative elapsed_time

There are no unique ids in my logs so i'm creating my own by adding multiple fields but the thing is that they may repeat over time.

My LOC #1457(END Tag) is matching with #1559 (START Tag) instead of #1450(START Tag).
#1450(Start Tag) is matching with #1556(END Tag) instead of #1457(END Tag).
It is also very non-deterministic in this when i run it multiple times with same logs.

I believe its not reading the logs in a serialized manner otherwise this problem would never happen. My input config :-

input {
file {
path => "/home/vsharma/Documents/logstash-5.1.2/bin/varun1.log"

Any way to get it logstash to go through my logs sequentially? Example :- line 1, line 2, 3....
Seems like logstash is sequential but threads in elapsed plugin are not. Any suggestion?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.