breaking lines before a regex

DrRandDumb — Fri, 09 Aug 2013 16:17:25 GMT

We have a tcp input that is merginging lines when they come in too fast.

I have (inputs)

[tcp://5140]
connection_host = dns
sourcetype=apigee
source=tcp:5140
index=apigee

I tried putting into props.conf the following info:

[apigee]
SHOULD_LINEMERGE = false

But this doesn't seem to work.

Is there a way to force this to always break on newlines - alternately, I could regex to break BEFORE the <11>?

here is an example that is munged:

<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/NPLUSBASKETBALL, target_path=/api/me/sport/activities/NPLUSBASKETBALL, client_id = 080a157bac0b57fd4a05073635652a4c,  forwarded_for_ip = 72.37.244.124, response_code = 500, total_response_time = 147, target_response_time = 52, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852510996, client_request_end_time_stamp = 1375852510997, target_request_start_time_stamp = 1375852511090, target_request_end_time_stamp = 1375852511090,  client_response_time_stamp = 1375852511143, client_response_end_time_stamp = 1375852511143, target_response_start_timestamp = 1375852511142, target_response_end_timestamp = 1375852511142
<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/Running, target_path=/api/me/sport/activities/Running, client_id = 080a157bac0b57fd4a05073635652a4c,  forwarded_for_ip = 72.37.244.124, response_code = 200, total_response_time = 243, target_response_time = 93, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852514060, client_request_end_time_stamp = 1375852514061, target_request_start_time_stamp = 1375852514210, target_request_end_time_stamp = 1375852514210,  client_response_time_stamp = 1375852514303, client_response_end_time_stamp = 1375852514303, target_response_start_timestamp = 1375852514303, target_response_end_timestamp = 1375852514303
<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/NPLUSKINECTTRG, target_path=/api/me/sport/activities/NPLUSKINECTTRG, client_id = 080a157bac0b57fd4a05073635652a4c,  forwarded_for_ip = 72.37.244.124, response_code = 500, total_response_time = 67, target_response_time = 28, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852516029, client_request_end_time_stamp = 1375852516029, target_request_start_time_stamp = 1375852516068, target_request_end_time_stamp = 1375852516068,  client_response_time_stamp = 1375852516096, client_response_end_time_stamp = 1375852516096, target_response_start_timestamp = 1375852516091, target_response_end_timestamp = 1375852516096
<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/NPLUSTRG, target_path=/api/me/sport/activities/NPLUSTRG, client_id = 080a157bac0b57fd4a05073635652a4c,  forwarded_for_ip = 72.37.244.124, response_code = 500, total_response_time = 157, target_response_time = 69, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852518106, client_request_end_time_stamp = 1375852518107, target_request_start_time_stamp = 1375852518194, target_request_end_time_stamp = 1375852518194,  client_response_time_stamp = 1375852518263, client_response_end_time_stamp = 1375852518263, target_response_start_timestamp = 1375852518263, target_response_end_timestamp = 1375852518263

Re: breaking lines before a regex

davecroto — Fri, 09 Aug 2013 16:41:41 GMT

Create a props.conf stanza for the sourcetype that you want to use and add this stanza

topic breaking lines before a regex in Getting Data In

breaking lines before a regex

Re: breaking lines before a regex