# Order of events after Split

**URL:** <https://discuss.elastic.co/t/order-of-events-after-split/114505>\
**Category:** Logstash\
**Created:** [January 8, 2018, 11:11am UTC](https://discuss.elastic.co/t/order-of-events-after-split/114505 "2018-01-08T11:11:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhavani\_Ananth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavani_ananth/32/45740_2.png) [@Bhavani\_Ananth](https://discuss.elastic.co/u/Bhavani_Ananth)\
**Post date:** [January 8, 2018, 11:11am UTC](https://discuss.elastic.co/t/order-of-events-after-split/114505/1 "2018-01-08T11:11:59Z")

</div>

Hello There,

Find the sample log at the end.

I am using the multiline codec in logstash to combine the lines without timestamp with tasks and then using split to get the following fields  
timestamp, processid, user, roleName (eg A) , taskName(eg Include OS-specific variables. TAGS: []) etc

Now, for the following line(s) include TAGS: [X], the roleName should be the roleName prior to the current include i.e roleName should be A and the taskName should be  
include TAGS: [X]. Likewise for include TAGS[XX], the roleName should be B.

After the split all the events are having the same timestamps. The order of events seem to be disrupted eg role A comes after include etc with the result the roleNames for all the include events are displayed either A or B.

Let me know the right approach that can be followed for this.  
Note: Am using the worker count as 1

Sample Log

2017-12-19 05:50:12,014 p=2271 u=xxxx | tasks:  
A : Include OS-specific variables. TAGS: []  
A : Include OS-specific variables for Fedora. TAGS: []  
A : Include version-specific variables for Ubuntu. TAGS: []  
A : Define java\_packages. TAGS: []  
include TAGS: [X]  
include TAGS: [Y]  
include TAGS: [Z]  
B: Task B desc1  
B: Task B desc 2  
include TAGS[XX]  
include TAGS[YY]

Thanks and Regards ,  
Bhavani

Hello There,  
Can someone throw light on this. Is the order of events changed after a split?

Thanks,  
Bhavani

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2018, 11:12am UTC](https://discuss.elastic.co/t/order-of-events-after-split/114505/2 "2018-02-05T11:12:12Z")

</div>

Closed on February 5, 2018, 11:12am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.