Multiline filter scrambling messages


#1

I am inputting logs using Logstash forwarder and using a multiline filter to build the logs into messages (each log is at least 2 lines). The problem is occasionally messages get mixed up.

An example of the file with 2 logs would be
Header1
Body1
Header 2
Body2

But the logs will show up later as
Header 1
Body 2
Body 1

Header 2

I am using a stream_identity => "%{host}.%{path}.%{type}.%{file}", but since these two logs are part of the same file, this is not being violated.

Is there any way I can guarantee that the logs will be built in the correct order?


(system) #2