Am getting multiline events. below events should be shown separately for each time. how to fix this . on my props.conf i have the below config. but it isn't working
BREAK_ONLY_BEFORE_DATE=true
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ
MAX_TIMESTAMP_LOOKAHEAD = 24
14/10/2020 19:46:58.035 | 2020-10-14T19:46:58.035+01:00 INFO [r] (default task-11) Checking user auth. [token(abbr.)=null,xForwardedFor=,remoteAddr=11.18xxx] 2020-10-14T19:46:58.035+01:00 INFO [] (default task-82) Checking user auth. [token(abbr.)=null,xForwardedFor=,remoteAddr=11.18xxx] 2020-10-14T19:46:58.035+01:00 INFO [] (default task-11) User token loaded. [windowsId=null,internal=false,externalOrigin=false,status=TOKEN_IS_NULL_OR_EMPTY] 2020-10-14T19:46:58.035+01:00 INFO [sso.AuthFilter |
The events aren't matching the TIME_FORMAT setting. Try these settings
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 30
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
The events aren't matching the TIME_FORMAT setting. Try these settings
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 30
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
Multiline events are solved now. but the line which should be on multiline like the postman commands and the result are also coming in separate line. any way to fix it ?
15/10/2020 06:06:16.069 | 1875094 < Transfer-Encoding: chunked
| |
15/10/2020 06:06:16.069 | 1875094 < Server: Apache-Coyote/1.1
| |
15/10/2020 06:06:16.069 | 1875094 < Date: Thu, 15 Oct 2020 05:06:15 GMT
| |
15/10/2020 06:06:16.069 | 1875094 < Content-Type: application/json;charset=UTF-8 |
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
I think it's OK.