topic Re: line breaker parameter in props.conf in Getting Data In

How do I use the line breaker parameter in props.conf?

ethanthomas — Mon, 06 Mar 2023 14:40:33 GMT

Can someone tell me how to use the line breaker parameter fo the below events which is currently getting clustered together .

{"sdsf shcdzvdvv zdcnvdzvvdd."}

{bfdf dvdfd dfdfdf ddgvdvdfd."}

{dfdfd dfdfd dgdgd dgdgdgdgg."}

Props .conf

LINE_BREAKER = (\.\"\})

richgalloway — Sat, 04 Mar 2023 01:19:50 GMT

A key thing to remember about LINE_BREAKER is the text matched by the first capture is discarded.

Based on my assumption that each event starts with a left brace this setting may work:

LINE_BREAKER = ([\r\n]+)\{

gcusello — Sat, 04 Mar 2023 06:30:33 GMT

could you share a sample of your complete logs?

Ciao.

Giuseppe