Accepted time is suspiciously far away from the previous event's time

[bschaap]

I'm ingesting logs that have both event timestamps as well as timestamps within the contents of the logs. My props.conf contains BREAK_ONLY_BEFORE=<[A-Z] but it's breaking on CONTENTDATE as well. It is not exceeding the 10K default max event character length. Does anyone have any suggestions?

&ltV ts="2018-07-16 22:14:28" &gt
...
...
CONTENTDATE=2017-11-30 10:48:11
...
...

[somesoni2]

Give this config a try

[yourSourceType]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\<\S+\s+ts\=)
TIME_PREFIX = ^\<\S+\s+ts\=\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 19

[adonio]

can you share masked events, and point out to where would you like it to break and which values are the desired timestamp?