I am inputting logs using Logstash forwarder and using a multiline filter to build the logs into messages (each log is at least 2 lines). The problem is occasionally messages get mixed up.
An example of the file with 2 logs would be
Header1
Body1
Header 2
Body2
But the logs will show up later as
Header 1
Body 2
Body 1
Header 2
I am using a stream_identity => "%{host}.%{path}.%{type}.%{file}", but since these two logs are part of the same file, this is not being violated.
Is there any way I can guarantee that the logs will be built in the correct order?