topic Re: Why is must_break_after configuration not working? in Getting Data In

Why is must_break_after configuration not working?

mjones414 — Thu, 28 Jan 2016 22:44:19 GMT

I have a large (10's of thousands of lines) data stream that runs every 10 minutes and I want it to break after this line:

sharing = default_shared

I tried putting in:

MUST_BREAK_AFTER = (sharing = default_shared)

But this did not work.

I was hoping it would take the literal string, but it's not working.

somesoni2 — Thu, 28 Jan 2016 22:59:52 GMT

Try something like this

[yoursourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER= ([\r\n]+)(?=sharing\s*=\s*default_shared)
... other configs....

mjones414 — Thu, 28 Jan 2016 23:10:11 GMT

Worked like a champ!! Thanks so much!