topic LINE_BREAKER not working correctly in Getting Data In

LINE_BREAKER not working correctly

pkeller — Wed, 25 Jan 2017 16:36:26 GMT

The event I want to break on looks like this:

25/Jan/17:10:23:00:069+0000 DEBUG Evaluation of condition [188:FTP Mastering Users] took 0 ms

props.conf looks like this:
LINE_BREAKER = ([\r\n]+)(\d+/\w{3}/\d+:\d{2}:\d{2}:\d{2}:\d{3})
I've also tried this:
LINE_BREAKER = ([\r\n]+)(\d+\/\w{3}\/\d+:\d{2}:\d{2}:\d{2}:\d{3})
TIME_FORMAT = %-m/%b/%y:%H:%M:%S:%3N%z
TRUNCATE = 0

I'm still finding that my indexers are now combining every event matching the REGEX into a single event ( until the max events boundary is reached )

I figure I'm getting hung up on the "forward slash" in the date vs what I have in the REGEX, but have not been able to ingest this particular datasource accurately. So do I need to go a step further with regards to

Re: LINE_BREAKER not working correctly

somesoni2 — Wed, 25 Jan 2017 16:42:04 GMT

Give this a try

[yourSourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\d+\/\w+\/\d+:\d+:\d+:\d+)
TIME_FORMAT = %d/%b/%y:%H:%M:%S:%N%z
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 27

Re: LINE_BREAKER not working correctly

woodcock — Wed, 25 Jan 2017 16:44:30 GMT

Try this:

([\r\n]+)(\d+\/\w{3}\/\d+:\d{2}:\d{2}:\d{2}:\d{3})

You can test your RegEx with http://www.regex101.com. This showed that you were not escaping your / characters.