# http.log q.
**URL:** https://community.zeek.org/t/http-log-q/5144
**Category:** Zeek
**Created:** [January 10, 2018, 10:49pm UTC](https://community.zeek.org/t/http-log-q/5144 "2018-01-10T22:49:46Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Dk\_Jack](https://community.zeek.org/u/Dk_Jack)
#### Post date: [January 10, 2018, 10:49pm UTC](https://community.zeek.org/t/http-log-q/5144/1 "2018-01-10T22:49:46Z")
Hi,
In a cluster environment, in the HTTP log, for the same connection-id i.e same 4-tuple and UID, is it ok if the transaction depth field value is lower than the ten-depth of some of the lines that came before it? for example, I am seeing txns as shown below…
1515542375.578187 CGR1kN3pynC8a3GXK1 10.20.11.1 7867 10.20.11.120 9453 79 POST …
1515542387.701328 CGR1kN3pynC8a3GXK1 10.20.11.1 7867 10.20.11.120 9453 90 POST …
1515542354.674611 CGR1kN3pynC8a3GXK1 10.20.11.1 7867 10.20.11.120 9453 55 POST …
1515542382.015911 CGR1kN3pynC8a3GXK1 10.20.11.1 7867 10.20.11.120 9453 85 POST …
Is this normal? What is the explanation. Thanks.
Dk.
---
### Author:  [@johanna](https://community.zeek.org/u/johanna)
#### Post date: [January 12, 2018, 4:55pm UTC](https://community.zeek.org/t/http-log-q/5144/2 "2018-01-12T16:55:34Z")
Hi,
If you take a look at the timestamps in the log that you posted you will
notice that the transaction depth value is in the correct order if you
sort the log by timestamp.
Bro log files are generally not guaranteed to be well-odered - though I am
admittedly not 100% sure without looking into the http scripts why the
http.log sent by a single worker would be reordered like that 🙂
I hope this helps,
Johanna
---
### Author:  [@seth](https://community.zeek.org/u/seth)
#### Post date: [January 13, 2018, 2:46pm UTC](https://community.zeek.org/t/http-log-q/5144/3 "2018-01-13T14:46:15Z")
Are these logs being written with the normal "ascii" log writer? If they are, I don't have a sensible explanation yet for why they would be out of order like that and I've never seen that behavior.
.Seth
---
### Author:  [@Dk\_Jack](https://community.zeek.org/u/Dk_Jack)
#### Post date: [January 13, 2018, 5:52pm UTC](https://community.zeek.org/t/http-log-q/5144/4 "2018-01-13T17:52:58Z")
Yes, they are being written using the default ascii writer
Bhasker.
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/http-log-q/5144/5 "2022-05-06T15:45:30Z")