topic Re: Unable to break xml without timestamp in Getting Data In

Unable to break xml without timestamp

Cuyose — Fri, 19 Sep 2014 00:52:25 GMT

I am trying to break these into separate events and have tried everything and its just not working

< sale id="1012128864" reportGroup="asdasd" customerId="7412213255"  >
            < orderId>101221348864 < /orderId >
            < amount>1999 < /amount >
            < orderSource >ecommerce < /orderSource >
            < token >
                <litleToken >8888888888888 < /litleToken >
                < expDate >1120 < /expDate >
            < /token >
        < / sale >

props.conf are

[custom_sourcetype]
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = \
SHOULD_LINEMERGE = true

Re: Unable to break xml without timestamp

somesoni2 — Fri, 19 Sep 2014 01:39:02 GMT

This is one event you have or you want to break these into separate entries?

Re: Unable to break xml without timestamp

Cuyose — Fri, 19 Sep 2014 03:13:27 GMT

Sorry, yes this is an example of a single event, with many others formatted the same. No matter what I try, it won't break them up.

Re: Unable to break xml without timestamp

somesoni2 — Fri, 19 Sep 2014 03:38:52 GMT

This works for me with your sample data.

props.conf are

[custom_sourcetype]
BREAK_ONLY_BEFORE = \<\s*sale\s
MUST_BREAK_AFTER = \<\s*/sale\s*\>
BREAK_ONLY_BEFORE_DATE = false
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
pulldown_type = 1

Re: Unable to break xml without timestamp

neelamssantosh — Fri, 19 Sep 2014 03:49:46 GMT

Kindly share couple of more
_raw logs from log file..

Re: Unable to break xml without timestamp

Cuyose — Fri, 19 Sep 2014 14:11:08 GMT

Odd this still doesn't work for me. I must have doe setting somewhere overriding this. Any ideas where it might be? The props.conf I am editing is definitely the etc/system/local.props.conf

Re: Unable to break xml without timestamp

Cuyose — Fri, 19 Sep 2014 15:09:48 GMT

It won't seem to let me upload the file, but literally there are just a bunch of blocks like this that are exactly the same with different element values. No timestamps

Re: Unable to break xml without timestamp

sowings — Fri, 19 Sep 2014 16:52:43 GMT

The only thing that overrides etc/system/local would be if you're using a clustered indexing setup, with custom rules pushed by the cluster master to the indexer peers. So unless you're in a cluster, system/local/props.conf is the king of the hill.

Re: Unable to break xml without timestamp

Cuyose — Fri, 19 Sep 2014 17:01:23 GMT

Hmm, im stumped then, because we definitely aren't doing that. Ill keep working on it.