# Logs event order mismatch

**URL:** <https://discuss.elastic.co/t/logs-event-order-mismatch/114896>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 10, 2018, 2:41pm UTC](https://discuss.elastic.co/t/logs-event-order-mismatch/114896 "2018-01-10T14:41:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yoga-sara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yoga-sara/32/27541_2.png) [@yoga-sara](https://discuss.elastic.co/u/yoga-sara)\
**Post date:** [January 10, 2018, 2:41pm UTC](https://discuss.elastic.co/t/logs-event-order-mismatch/114896/1 "2018-01-10T14:41:00Z")

</div>

Am using 5LK 5.6.4.  
Beats =\> Logstash =\> ElasticSearch =\>Kibana

I am collets server logs(using grok and mutate filter) and another one, I parse the whole XML in ELK(using multiline and XML filter plugin).

For Log: While beat collects data, It is not in proper order.  
For XML: While too many events at the time it splits the XML

 ![xml-server-log](https://us1.discourse-cdn.com/elastic/original/3X/a/e/ae748ea86785ac231a7d345380bc05923ea2652d.png)

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 11, 2018, 12:45pm UTC](https://discuss.elastic.co/t/logs-event-order-mismatch/114896/2 "2018-01-11T12:45:50Z")

</div>

Where do you apply the multiline filtering? Multiline should be done in filebeat.

---

<div class="post-metadata">

**Author:** ![yoga-sara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yoga-sara/32/27541_2.png) [@yoga-sara](https://discuss.elastic.co/u/yoga-sara)\
**Post date:** [January 17, 2018, 5:25am UTC](https://discuss.elastic.co/t/logs-event-order-mismatch/114896/3 "2018-01-17T05:25:59Z")

</div>

I use a multiline filter in logstash.  
My filebeat send different type of files. I want multiline for a specific file type. If I apply multiline in filebeat is it impact all formate?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 18, 2018, 1:59pm UTC](https://discuss.elastic.co/t/logs-event-order-mismatch/114896/4 "2018-01-18T13:59:03Z")

</div>

In case of errors, loadbalancing or filebeat processing multiple files, you can not guarantee correct order in Logstash. Doing multiline in filebeat preserves correct order.

> If I apply multiline in filebeat is it impact all formate?

What do you mean by "impact all formate" ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2018, 1:59pm UTC](https://discuss.elastic.co/t/logs-event-order-mismatch/114896/5 "2018-02-15T13:59:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.