topic Re: need props.conf for custom log in Getting Data In

need props.conf for custom log

rileyken — Wed, 09 Apr 2014 11:45:41 GMT

I have a custom log in the format where each new record has a entry followed by a pipe (|)

example log:
< date time> |

< date time> |

....

How do I get it to split records on the line that ends in pipe?

Re: need props.conf for custom log

MuS — Wed, 09 Apr 2014 11:52:36 GMT

Hi rileyken,

set in your props.conf for that sourcetype something like this:

LINE_BREAKER = \|

Maybe you also need to set

SHOULD_LINEMERGE = [true|false]
* Defaults to true.

to false.....

hope this helps ...

cheers, MuS

Re: need props.conf for custom log

rileyken — Wed, 09 Apr 2014 12:49:46 GMT

I am wondering about the xml payload aspect of it in my sample log I have two events each with an event def (ending in pipe) followed by a xml payload which can be 5 lines to maybe 50 lines max

< date time> |

< date time> |

does the line break on | and the line merge take care of having all of the xml payload in the same event"