log file not parsing properly - multiple lines per event

dglass0215 — Wed, 30 Sep 2020 03:27:17 GMT

Hello,

I have a file monitor for a log file where I am getting indexed data with multiple lines. Example of one event:

2019-12-30 09:16:41:908: Requestor: IMM_Mobile, IsLocal: False
2019-12-30 09:16:41:908: 637132942019089151: Scanned CID: BARCODE:

Now i notice that it is the same time but they should still be separate events. i have read where someone suggested SHOULD_LINEMERGE = false, however if I am reading the documentation correctly, the SHOULD_LINEMERGE = true and BREAK_ONLY_BEFORE_DATE = true being the defaults should be processing the above as two separate events. What am I misunderstanding?

I am hesitant to configure SHOULD_LINEMERGE = false because I think it may be needed for other events that span multiple lines.

only other thing I can think of is possibly my props/transforms might be screwing with the data in some other way. Below are what I think are the relevant portions of my props/transforms:

Props:
[mySourceType]
TRANSFORMS-set= setnull,setparsing
TRANSFORMS-sourcetype= setNewSourceType

Transforms:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = \b(?:offline|online|\d{4}-d{2}-d{2}\s+\d{2}:\d{2}:\d{2}:\d{3}:\s+\d{18}:\s)\b
DESK_KEY = queue
FORMAT = indexQueue

[setNewSourceType]
REGEX = \b(\d{4}-d{2}-d{2}\s+\d{2}:\d{2}:\d{2}:\d{3}:\s+\d{18}:\s)
FORMAT = sourcetype::NewSourceType
DEST_KEY = MetaData:Sourcetype

Thanks for any assistance!
David

Re: log file not parsing properly - multiple lines per event

mydog8it — Tue, 31 Dec 2019 15:31:14 GMT

Take a look at this data onboarding cheat sheet published by Aplura, it is a great guide to establish your data onboarding practices:
https://www.aplura.com/assets/pdf/onboarding_cheatsheet.pdf

Re: log file not parsing properly - multiple lines per event

dglass0215 — Thu, 02 Jan 2020 18:58:16 GMT

While this might be slightly useful it does not answer my question. Do you know why the two lines above are one event? And do you know how I can fix it? Thanks!

topic Re: log file not parsing properly - multiple lines per event in Getting Data In

log file not parsing properly - multiple lines per event

Re: log file not parsing properly - multiple lines per event

Re: log file not parsing properly - multiple lines per event