How do I write props.cof for below log structure?

sathiyasun — Thu, 10 Mar 2022 21:32:21 GMT

Actual log:-

[{area: "CU", subid: "M", slgdattim: "2022022109515500", slgproc: "1362100032D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "jhuytvfghju789", slguser: "r4uhjk8", slgtc: "SE38", dummy3: "Z0097TORRENT_INBOUND", term_ipv6: "167.211.0.9", sal_data: "Jump to BAP Debugger by user C7C2QC(200): SourceLine:233->228, ByteCode(offset):MOVL(433)->mvqk(423) (Prgm:Z0097TORRENT_INBOUND, Meth:READ_DATA, Incl:Z0097TORRENT_INBOUND_M01, Line:228)"}, {area: "CU", subid: "M", slgdattim: "2022022111111200", slgproc: "0797100035D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "PS2WVV212651CF", slguser: "C6W7RZ", slgtc: "VKM1",dummy2: "D01", term_ipv6: "167.211.0.6", sal_data: "Jump to BAP Debugger by user C6W7RZ(200): SourceLine:48->63, ByteCode(offset):cmpr(2588)->cmpr(2603) (Prgm:PDB, Form:USER_EXIT_FUELLEN, Incl:ffujlkk_ADD_FIELDS, Line:63)"}, {area: "CU", subid: "M", slgdattim: "2022022111122600", slgproc: "0797100035D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "PS2WVV212651CF", slguser: "C6W7RZ", slgtc: "VKM1", dummy1: "D01", term_ipv6: "167.211.0.6", sal_data: "Jump to BAP Debugger by user C6W7RZ(200): SourceLine:63->77, ByteCode(offset):cmpr(2603)->cmpr(2650) (Prgm:APDB, Form:USER_EXIT_FUELLEN, Incl:hgguytol_ADD_FIELDS, Line:77)"}]

I want the above log break into three events like below & pls let me now the props.conf

Event1:-

[{area: "CU", subid: "M", slgdattim: "2022022109515500", slgproc: "1362100032D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "jhuytvfghju789", slguser: "r4uhjk8", slgtc: "SE38", dummy3: "Z0097TORRENT_INBOUND", term_ipv6: "167.211.0.9", sal_data: "Jump to BAP Debugger by user C7C2QC(200): SourceLine:233->228, ByteCode(offset):MOVL(433)->mvqk(423) (Prgm:Z0097TORRENT_INBOUND, Meth:READ_DATA, Incl:Z0097TORRENT_INBOUND_M01, Line:228)"}, {area: "CU", subid: "M", slgdattim: "2022022111111200", slgproc: "0797100035D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "PS2WVV212651CF", slguser: "C6W7RZ", slgtc: "VKM1",dummy2: "D01", term_ipv6: "167.211.0.6", sal_data: "Jump to BAP Debugger by user C6W7RZ(200): SourceLine:48->63, ByteCode(offset):cmpr(2588)->cmpr(2603) (Prgm:PDB, Form:USER_EXIT_FUELLEN, Incl:ffujlkk_ADD_FIELDS, Line:63)"}, {area: "CU", subid: "M", slgdattim: "2022022111122600", slgproc: "0797100035D2", slgmand: "200", sid: "S4D", instance: "dummy", counter: "0 ", slgltrm2: "jhuytvfghju789", slguser: "C6W7RZ", slgtc: "VKM1", dummy1: "D01", term_ipv6: "167.211.0.6", sal_data: "Jump to BAP Debugger by user C6W7RZ(200): SourceLine:63->77, ByteCode(offset):cmpr(2603)->cmpr(2650) (Prgm:APDB, Form:USER_EXIT_FUELLEN, Incl:hgguytol_ADD_FIELDS, Line:77)"}]

Re: How do I write props.cof for below log structure?

richgalloway — Fri, 11 Mar 2022 00:58:01 GMT

Try these props.conf settings.

[mysourcetype] LINE_BREAKER = ([\[\s])\{area TIME_PREFIX = sigdattim: TIME_FORMAT = %Y%d%m%H%M%S%2N MAX_TIMESTAMP_LOOKAHEAD = 18 SHOULD_LINEMERGE = false

topic Re: How do I write props.cof for below log structure? in Getting Data In

How do I write props.cof for below log structure?

Re: How do I write props.cof for below log structure?