I down load the "PT1H.json" from storage account on Azure Portal GUI.

And compare with local file on logstash host.
And found the local file's log count is more than source file.

in "PT1H.json" , only just 1 log(I just test a ssh login event).
But in local file ,there are 3 line logs.
Below is my pipeline:
