Why is LINE_BREAKER not working?

fitzgej_entrust — Wed, 11 May 2022 20:25:14 GMT

I'm having some issues getting my LINE_BREAKER configuration to work for a custom log file. I've tested the RegEx and it matches the beginning of every line, however it's still breaking extremely strangely. Here's the configuration we're running as well as a sample of the log.

The screenshot at the bottom is what it's actually doing.

MAX_TIMESTAMP_LOOKAHEAD = 20 TIME_FORMAT = %Y-%m-%d_%I%M %p TIME_PREFIX = ^ TZ = MST SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\d{4}-\d{2}-\d{2}_\d{4} [A|P]M[\s\r\n]+\d{2} --- 2022-05-10_1120 AM 10.12.14.3 HSM device 0: HSM in NORMAL MODE. RESPONDING. Usage Level=0% 2022-05-10_1120 AM 10.12.14.4 HSM device 0: HSM in NORMAL MODE. RESPONDING. Usage Level=0% 2022-05-10_1120 AM 10.12.14.5 HSM device 0: HSM in NORMAL MODE. RESPONDING. Usage Level=0% 2022-05-10_1120 AM 10.12.14.81 HSM device 0: HSM in NORMAL MODE. RESPONDING. Usage Level=58% 2022-05-10_1120 AM 10.12.14.82 HSM device 0: HSM in NORMAL MODE. RESPONDING. Usage Level=73% 2022-05-10_1120 AM 10.12.14.88 HSM device 0: HSM in NORMAL MODE. RESPONDING. Usage Level=0% 2022-05-10_1120 AM 10.12.14.91 HSM device 0: HSM in NORMAL MODE. RESPONDING. Usage Level=0%

Re: LINE_BREAKER Not working?

somesoni2 — Wed, 11 May 2022 18:12:28 GMT

Give this a try

On your indexer/heavy forwarder (whichever comes first)

[yourSourceType] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?=\d{4}-\d{2}-\d{2}_\d{4} [A|P]M) MAX_TIMESTAMP_LOOKAHEAD = 18 TIME_FORMAT = %Y-%m-%d_%I%M %p TIME_PREFIX = ^ TZ = MST

Re: LINE_BREAKER Not working?

fitzgej_entrust — Wed, 11 May 2022 20:40:08 GMT

...I can not believe I was trying to run that on the Universal forwarder. Worked like a charm, and thank you for the catch there.

topic Why is LINE_BREAKER not working? in Getting Data In

Why is LINE_BREAKER not working?

Re: LINE_BREAKER Not working?

Re: LINE_BREAKER Not working?