Find the sample log at the end.
I am using the multiline codec in logstash to combine the lines without timestamp with tasks and then using split to get the following fields
timestamp, processid, user, roleName (eg A) , taskName(eg Include OS-specific variables. TAGS: ) etc
Now, for the following line(s) include TAGS: [X], the roleName should be the roleName prior to the current include i.e roleName should be A and the taskName should be
include TAGS: [X]. Likewise for include TAGS[XX], the roleName should be B.
After the split all the events are having the same timestamps. The order of events seem to be disrupted eg role A comes after include etc with the result the roleNames for all the include events are displayed either A or B.
Let me know the right approach that can be followed for this.
Note: Am using the worker count as 1
2017-12-19 05:50:12,014 p=2271 u=xxxx | tasks:
A : Include OS-specific variables. TAGS: 
A : Include OS-specific variables for Fedora. TAGS: 
A : Include version-specific variables for Ubuntu. TAGS: 
A : Define java_packages. TAGS: 
include TAGS: [X]
include TAGS: [Y]
include TAGS: [Z]
B: Task B desc1
B: Task B desc 2
Thanks and Regards ,
Can someone throw light on this. Is the order of events changed after a split?