I'm ingesting logs that have both event timestamps as well as timestamps within the contents of the logs. My props.conf contains BREAK_ONLY_BEFORE=<[A-Z] but it's breaking on CONTENTDATE as well. It is not exceeding the 10K default max event character length. Does anyone have any suggestions?
<V ts="2018-07-16 22:14:28" >
...
...
CONTENTDATE=2017-11-30 10:48:11
...
...
Give this config a try
[yourSourceType]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\<\S+\s+ts\=)
TIME_PREFIX = ^\<\S+\s+ts\=\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 19
can you share masked events, and point out to where would you like it to break and which values are the desired timestamp?