After the first log is being sent to the log server, additional update can be created by the GW and those are being also send to the log server. Each update considered to be individual log.
The log exporter has 2 running modes:
1. Raw (default) - in this mode the updates will be exporter as is, meaning, just the delta
2. Semi unified - in this mode, the log exporter will export an aggregated version of the log (with all the data) for every update
If you are using Splunk, you can take a look at our new app for Splunk. The queries we implemented there can join the duplicated data (in semi unified mode) and show you just the latest one.