topic Re: How to write Linebreaker rule for the below events? in Getting Data In

How to write Linebreaker rule for the below events?

lksridhar — Wed, 30 May 2018 16:34:23 GMT

Hi Team,

We have ingested the NSG flow logs from azure and few events are not breaking the events properly, could you please help me to write the LINE_BREAKER rule for below events.

Sample events:

"time":"2018-05-30T16:07:43.6682050Z","systemId":"","category":"NetworkSecurityGroupFlowEvent","12000,T,O,A"]}]}]}{"time":"2018-05-30T16:06:43.6499999Z","systemId":"","category":"NetworkSecurityGroupFlowEvent","resourceId":"/,T,O,A"]}]}]}{"time":"2018-05-30T16:06:43.6499999Z","systemId":"","category":"NetworkSecurityGroupFlowEvent","resourceId":"/,T,O,A"]}]}]}

LINE_BREAKER=?

Re: How to write Linebreaker rule for the below events?

niketn — Wed, 30 May 2018 17:24:02 GMT

@lksridhar, can you try with this?

LINE_BREAKER=(]}]}]})
TIME_PREFIX="time":
MAX_TIMESTAMP_LOOKAHEAD=29

Re: How to write Linebreaker rule for the below events?

somesoni2 — Wed, 30 May 2018 21:53:25 GMT

Are you missing a curly bracket in the line 1??

Re: How to write Linebreaker rule for the below events?

dpetracca_splun — Tue, 29 Sep 2020 19:44:07 GMT

I came to same conclusion as @niketn
I tested it out and here is the props.conf that works:

[test_line_break]
DATETIME_CONFIG =
LINE_BREAKER = (]}]}]})
MAX_TIMESTAMP_LOOKAHEAD = 27
NO_BINARY_CHECK = true
TIME_PREFIX = time
category = Custom
disabled = false
pulldown_type = true

Re: How to write Linebreaker rule for the below events?

niketn — Thu, 31 May 2018 05:29:53 GMT

@dpetracca I had MAX_TIMESTAMP_LOOKAHEAD as 29 to extract even the timezone. Are you planning to apply TIMESTAMP_FORMAT %6N and stop Timestamp extraction?

Re: How to write Linebreaker rule for the below events?

dpetracca_splun — Thu, 31 May 2018 12:57:52 GMT

@niketnilay, no your 29 is correct, I wasn't looking at timezone. Was more focused on the line break actually.

Re: How to write Linebreaker rule for the below events?

lksridhar — Tue, 29 Sep 2020 19:44:27 GMT

Thanks nikentilay and dpetracca for your input. i tried nikentilay command it is working for me.

LINE_BREAKER=(]}]}]})
TIME_PREFIX="time":
MAX_TIMESTAMP_LOOKAHEAD=29

Thanks for helping to fix the issue.

Re: How to write Linebreaker rule for the below events?

niketn — Thu, 31 May 2018 14:05:13 GMT

@lksridhar, great to hear that your issue is resolved. I have converted my comment to answer. Please accept to mark this question as answered!

Re: How to write Linebreaker rule for the below events?

dpetracca_splun — Thu, 31 May 2018 14:23:55 GMT

hey guys, sorry for making my comment an answer. For some reason, it won't allow me to make comments, only answers.... ???
When I click on "comment" it drops down to the main answers section.