Logs event order mismatch

Elastic Stack Beats
1

Am using 5LK 5.6.4.
Beats => Logstash => ElasticSearch =>Kibana

I am collets server logs(using grok and mutate filter) and another one, I parse the whole XML in ELK(using multiline and XML filter plugin).

For Log: While beat collects data, It is not in proper order.
For XML: While too many events at the time it splits the XML

xml-server-log
xml-server-log.png882×110 5.8 KB

2

Where do you apply the multiline filtering? Multiline should be done in filebeat.

1 Like
3

I use a multiline filter in logstash.
My filebeat send different type of files. I want multiline for a specific file type. If I apply multiline in filebeat is it impact all formate?

4

In case of errors, loadbalancing or filebeat processing multiple files, you can not guarantee correct order in Logstash. Doing multiline in filebeat preserves correct order.

If I apply multiline in filebeat is it impact all formate?

What do you mean by "impact all formate" ?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.