Clarify using multiple syslog appenders to TCP input with multiline codec

[obaqazi-red]

Hello ,

We have many instances for an app that use syslog to send log4j2 logs to logstash.
we use TCP input with multiline codec to collect logs by timestamp into single event and then send it to elasticsearch .

The Question is does the multiline codec in the TCP input know from where this event came so it will not mix the event from different syslog clients ?

Best wishes