A line breaking RegEx change was mistakenly made to one of our sourcetype. We caught the error a few hours later but now we ended up with multiple events indexed as one. We have since fixed the RegEx but this impacted several hundred log files with several million events and some original logs on the server have been rolled and purged so delete and reindex isn't an option. Is there any way to reprocess event line breaking in place?
I don't know of a way, sorry. We talk about six "immutable" quantities related to indexed events: index, source, sourcetype, event time, line breaks, and host(name). I have a feeling that once it's indexed that way, you're stuck.
