topic Line Breaking for netstat only breaks on the first line in Getting Data In

Line Breaking for netstat only breaks on the first line

ekenne06 — Fri, 02 Oct 2020 22:28:55 GMT

have a scripted input that runs:

netstat -tupn and the output shows:

tcp x.x.x.x:38314 x.x.x.x:7075 ESTABLISHED 4144/java

tcp x.x.x.x:22 x.x.x.x:62601 ESTABLISHED 5830/sshd:

tcp x.x.x.x:37032 x.x.x.x:8080 ESTABLISHED 4144/java

tcp x.x.x.x:59344 x.x.x.x:49302 ESTABLISHED 4144/java

in my props.conf I have

[<sourcetype>]

BREAK_ONLY_BEFORE = (tcp)

SHOULD_LINEMERGE = false

the events are getting indexed but I only see the first event

tcp x.x.x.x:38314 x.x.x.x:7075 ESTABLISHED 4144/java

and nothing else gets indexed. What am I missing?

Re: Line Breaking for netstat only breaks on the first line

thambisetty — Sat, 03 Oct 2020 04:42:20 GMT

Change SHOULD_LINEMERGE = True

Re: Line Breaking for netstat only breaks on the first line

ekenne06 — Sat, 03 Oct 2020 14:18:40 GMT

Why is that? I thought LINEMERGE meant taking individual events and making them 1 single event? I have a multi line event that I want to be single events. Am I miss understanding that line?