in reply to output the read result into a log file

In your example,
the script always find just one line with the 'two' keyword and the same id from the log file.

So you never go inside the

if ( defined($lookup{$refs}) && $lookup{$refs} + $time_delta <= $t +imestamp )
statement and there is no output.

And $lookup{$refs} + $time_delta is always greater than $timestamp

Maybe it's different in your real log file ?

hth,

PooLpi