# Multiline filter scrambling messages

**URL:** <https://discuss.elastic.co/t/multiline-filter-scrambling-messages/26186>\
**Category:** Logstash\
**Created:** [July 23, 2015, 6:58pm UTC](https://discuss.elastic.co/t/multiline-filter-scrambling-messages/26186 "2015-07-23T18:58:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![psampson](https://avatars.discourse-cdn.com/v4/letter/p/22d042/32.png) [@psampson](https://discuss.elastic.co/u/psampson)\
**Post date:** [July 23, 2015, 6:58pm UTC](https://discuss.elastic.co/t/multiline-filter-scrambling-messages/26186/1 "2015-07-23T18:58:44Z")

</div>

I am inputting logs using Logstash forwarder and using a multiline filter to build the logs into messages (each log is at least 2 lines). The problem is occasionally messages get mixed up.

An example of the file with 2 logs would be  
Header1  
Body1  
Header 2  
Body2

But the logs will show up later as  
Header 1  
Body 2  
Body 1

Header 2

I am using a stream\_identity =\> "%{host}.%{path}.%{type}.%{file}", but since these two logs are part of the same file, this is not being violated.

Is there any way I can guarantee that the logs will be built in the correct order?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/multiline-filter-scrambling-messages/26186/2 "2017-07-06T05:33:55Z")

</div>

Closed on July 6, 2017, 5:33am UTC