https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-event-break-a-multi-line-file-into-single/m-p/527090#M88903 <P>hey tried the same but that is not working&nbsp;</P><P>SHOULD_LINEMERGE = false</P><P>LINE_BREAKER=([\r\n]+)\}()\{id:</P><P>&nbsp;</P> Thu, 29 Oct 2020 13:41:29 GMT Hemnaath 2020-10-29T13:41:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-event-break-a-multi-line-file-into-single/m-p/527013#M88884 <P>I have multi line file (_json), which I am trying to create a individual events, the multi line file contains array of id, message and timestamp.</P><P>Sample Event data:&nbsp;</P><P>{ [-]<BR />logEvents: [ [-]<BR />{ [-]<BR />id: 3576745055635743000077342515139507954347666517578940416<BR />message: START RequestId: 4e1251df-11d9-55d0-918a-09bb06b96122 Version: $LATEST</P><P>timestamp: 1603867953198<BR />}<BR />{ [+]<BR />}<BR />{ [-]<BR />id: 35767450557316368740614159310005543840071546062336098306<BR />message: [2020-10-28T06:52:33.240Z][4e1251df-11d9-55d0-918c-09cc06b96122][INFO][wfm-test2-lmd-towSyncWorkOrderWOM][HeaderProcessor.py, 23][The filtered request headers are {"test-PartyID": "test"}]</P><P>timestamp: 1603867953241<BR />}<BR />{ [+]<BR />}<BR />{ [-]<BR />id: 3576745057558067905821073966314329716666554135734059012<BR />message: [2020-10-28T06:52:34.59Z][4e1251df-11d9-55d0-918c-09cc06b96122][INFO][wfm-test2-lmd-towSyncWorkOrderWOM][lambda_function.py, 37][Response received from SNOW with status code :202 and response as {"result":{"message":"Message has been received!","value":"WOR200033942808"}}]</P><P>timestamp: 1603867954060<BR />}<BR />{ [+]<BR />}<BR />{ [+]<BR />}<BR />]<BR />logGroup: /aws/lambda/wfm-test2-lmd-towSyncWorkOrderWOM<BR />logStream: 2020/10/28/[$LATEST]0e5e38b8bf8e4247a5f063e5e1fdaf51<BR />messageType: DATA_MESSAGE<BR />owner: 126208963777<BR />subscriptionFilters: [ [+]<BR />]</P><P>Can you please guide me how to break this multi line event using the line breaker.</P> Thu, 29 Oct 2020 07:55:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-event-break-a-multi-line-file-into-single/m-p/527013#M88884 Hemnaath 2020-10-29T07:55:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-event-break-a-multi-line-file-into-single/m-p/527078#M88896 <P>Have you tried&nbsp;</P><LI-CODE lang="markup">LINE_BREAKER = \}()\{id:</LI-CODE> Thu, 29 Oct 2020 13:01:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-event-break-a-multi-line-file-into-single/m-p/527078#M88896 richgalloway 2020-10-29T13:01:09Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-event-break-a-multi-line-file-into-single/m-p/527090#M88903 <P>hey tried the same but that is not working&nbsp;</P><P>SHOULD_LINEMERGE = false</P><P>LINE_BREAKER=([\r\n]+)\}()\{id:</P><P>&nbsp;</P> Thu, 29 Oct 2020 13:41:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-event-break-a-multi-line-file-into-single/m-p/527090#M88903 Hemnaath 2020-10-29T13:41:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-event-break-a-multi-line-file-into-single/m-p/527194#M88919 <P>Hey I was able to break the multi line events into single events using the below stanza&nbsp;</P><P>SHOULD_LINEMERGE=false<BR />LINE_BREAKER=(\[|,\s*|\], )({"id":|"logGroup":)<BR />disabled=false<BR />MAX_TIMESTAMP_LOOKAHEAD=13<BR />TIME_FORMAT=%s%3Q<BR />TIME_PREFIX="timestamp":\s+<BR />TZ=UTC<BR />TRUNCATE=100000</P> Fri, 30 Oct 2020 02:31:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-regex-to-event-break-a-multi-line-file-into-single/m-p/527194#M88919 Hemnaath 2020-10-30T02:31:11Z