How to break two lines of JSON read as one event?

[devpaymentcloud]

Hi,

Currently, I am having hard times to break these 2 JSON lines. They are being read by Splunk as one event. This happens for some type of events (being treated as one)

{"timestamp":"2019-09-05 01:59:50.138","serviceId":"stg-test-serviceID","paymentId":"RCF-C-20190905-0500005984","subServiceId":"stg-test-subServiceID","currencyCode":"JPY","grossAmount":"10000","agencyCode":"testcard","headers":{"x-forwarded-for":"x.x.x.x, 1x.x.x.x","x-forwarded-host":"payment-stg.test.com","connection":"Keep-Alive","via":"1.1 ceba831d448dcb90619d3ded470da482.cloudfront.net (CloudFront)","content-type":"application/x-www-form-urlencoded;charset=UTF-8","x-amzn-trace-id":"Root=1-5d706c16-ba866da04bbbc7b8e10d39c4","x-amz-cf-id":"ejIUaspbrJTfob4bNDQc55OSToFHCg6Wr0LR5SuXgW-4IbszpUnFUw==","content-length":"777","x-forwarded-server":"test-server","true-client-ip":"x.x.x.x","host":"test-stg.test.com","x-forwarded-proto":"https","user-agent":"Java/1.8.0_181 request_id=6t_ct3VepKx7CndjiIWxSv8R0HXpu_hnXfgeGtG24e5yViUBDGIWWA==","accept":"application/json, application/*+json","x-forwarded-port":"443"},"paymentMethodCode":"CARD_TOKEN","order":{"version":1,"email":"[email protected]","ipAddress":"x.x.x.x","items":[{"id":"INVST001","price":"10000","quantity":"1","name":"投信積立"}]},"trackingId":"TRK1909050159501988fCtv"}
{"timestamp":"2019-09-05 01:59:50.651","serviceId":"stg-es-test","paymentId":"AUTO_190905015950649Bsq68niXch3Z05pmi3mreZwzJaD7eO","callbackUrl":"http://localhost","subServiceId":"stg-es-wuaki","custom":"ABCabc123","currencyCode":"EUR","grossAmount":"123","serviceReferenceId":"ABCabc123","agencyCode":"test","headers":{"x-forwarded-for":"x.x.x.x, x.x.x.x","x-forwarded-host":"test-stg.test.com","accept-encoding":"gzip,deflate","connection":"Keep-Alive","via":"1.1 59c75ec1fe1ecd5f3e844673234e9dfc.cloudfront.net (CloudFront)","content-type":"application/x-www-form-urlencoded","x-amzn-trace-id":"Root=1-5d706c16-403958dabc9db68a4f63c2dc","x-amz-cf-id":"00d_4IznNmPvjT4MjHGkmHPEZ8sWcR7eB3QSd59wo4f4IQWDCcRMcA==","content-length":"1433","x-forwarded-server":"test-server","true-client-ip":"x.x.x.x","host":"test-test.com","x-forwarded-proto":"https","user-agent":"Apache-HttpClient/4.1.1 (java 1.5) request_id=a6A9DWJm5DdZHuGq36vsSey9Q1orXuWQfuTGflHnLENWCL1D4K4k6g==","x-forwarded-port":"443"},"paymentMethodCode":"CARD_TOKEN","order":{"version":1,"email":"[email protected]","memberId":"Accept--0-xxxx","ipAddress":"127.0.0.1","shippingAddress":{"name":"ABC漢字abcてすと1213テストÇç","street":"ABC漢字abcてすと1213テストÇç","city":"ABC漢字abcてすと1213テストÇç","state":"ABC漢字abcてすと1213テストÇç","postalCode":"ABab12#$^","phone":"+5511222-3344-55-66","countryCode":"ES"},"items":[{"id":"ABab12#$^","price":"123","quantity":"1","name":"ABC漢字abcてすと1213テストÇç"}]},"trackingId":"TRK1909050159507588Gw8i"}

Currently, my props.conf is set to this:

SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=^\{\"timestamp\"

I also already tried this setting from the other pages found in this same forum:

 SHOULD_LINEMERGE = false
 LINE_BREAKER = \{\"timestamp
 TIME_PREFIX = timestamp\"\:
 MAX_TIMESTAMP_LOOKAHEAD = 10

But did not work. I also tried to modify LINE_BREAKER and BREAK_ONLY_BEFORE with other types but still not successful.

I am thinking maybe it's because of the log format is different? But it only comes from one source.

[devpaymentcloud]

I tried to check some logs but there are some logs with exactly the same fields but still merged on the same line.

Here are the ff links I tried:
https://answers.splunk.com/answers/511589/how-to-configure-line-breaking-for-my-sample-json.html
https://answers.splunk.com/answers/558993/how-to-prevent-splunk-from-merging-few-json-string.html
https://answers.splunk.com/answers/171197/how-to-get-two-lines-of-json-to-break-as-two-event.html?ut...