Merge log data from 2 different sources

In the SQL world, if I'm understanding your question correctly, the equivalent would be an upsert. Unfortunately, LA does not today support this. However, because of the performance of the engine, we recommend in scenarios like yours that you index your data, and then select only the latest version when querying your data to dedup it. The other option of course is to handle it client side via robust retry logic, though this is more involved. Lastly, and this is not an option I've tried myself, but there exists a community-developed LogStash adapter for an OMS sink, LogStash potentially having some built in logic for dealing with rotating logs that you might find useful. Sorry for not having a cleaner answer for you, but hopefully one of these will work!