Order of events after Split

Hello There,

Find the sample log at the end.

I am using the multiline codec in logstash to combine the lines without timestamp with tasks and then using split to get the following fields
timestamp, processid, user, roleName (eg A) , taskName(eg Include OS-specific variables. TAGS: []) etc

Now, for the following line(s) include TAGS: [X], the roleName should be the roleName prior to the current include i.e roleName should be A and the taskName should be
include TAGS: [X]. Likewise for include TAGS[XX], the roleName should be B.

After the split all the events are having the same timestamps. The order of events seem to be disrupted eg role A comes after include etc with the result the roleNames for all the include events are displayed either A or B.

Let me know the right approach that can be followed for this.
Note: Am using the worker count as 1

Sample Log

2017-12-19 05:50:12,014 p=2271 u=xxxx | tasks:
A : Include OS-specific variables. TAGS: []
A : Include OS-specific variables for Fedora. TAGS: []
A : Include version-specific variables for Ubuntu. TAGS: []
A : Define java_packages. TAGS: []
include TAGS: [X]
include TAGS: [Y]
include TAGS: [Z]
B: Task B desc1
B: Task B desc 2
include TAGS[XX]
include TAGS[YY]

Thanks and Regards ,
Bhavani

Hello There,
Can someone throw light on this. Is the order of events changed after a split?

Thanks,
Bhavani

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.