when json log input to logstash server...
- example json log contain long message feild, probably multiple line for a parameter...We need to used multi line plugin to parse that in logstash server. If the shipper is syslog.
logstash capture json logs show incosistant behavious..some logs get merged to other set and json log inconsistance visible for those logs message. either some message get clubbed or broked(half message ) stored in eleastic search db through logstash server. this happen due to incorrect parsing.
So syslog and multiline doestn work as expected.
tcp appender do maintain correct sequence and streaming of logs and same can be captured to logstash server without multiline plugin.