Each line starting at "type" would come in as their own log, the timestamp and id number match up to show they are a single event. They are not guaranteed to be ordered. I may want to search on say "syscall" for alerting, but then I would only get the first line of each event. At that point is where it becomes cumbersome, because I can search the id and get the rest of the event, but when I am searching through a lot of them, I can't even tell if its interesting until I see the other parts.