I am creating a sourcetype but my lines are not breaking properly here is my stanza :
{"TimeStampString":"6/5/2019 7:47:15 PM","Message":{"StatusCode":"200","DateTime":"6/5/2019 7:47:15 PM","RequestId":"fda7b031-46a3-4b5c-8edf-fa728564d6c9","TransactionType":"api-estfmer-trace-response"},"Priority":0,"Severity":"Information","EventId":0,"Title":"","MachineName":"SWET2WC9A005","AppDomainName":"/LM/W3SVC/9/ROOT/ESTFMER-2-132042366915126615","ProcessId":"72076","ProcessName":"c:\\windows\\system32\\inetsrv\\w3wp.exe","ManagedThreadName":"","ActivityId":"00000000-0000-0000-0000-000000000000","Win32ThreadId":"86496","RelatedActivityId":"","ErrorMessages":"","CategoriesStrings":["Business"]}
I want to break the lines from status code and so on,
below is my config :
[ ]
BREAK_ONLY_BEFORE=^{
CHARSET=UTF-8
MAX_TIMESTAMP_LOOKAHEAD=43
SHOULD_LINEMERGE=true
disabled=false
TIME_FORMAT=%m/%d/%Y %H:%M:%S %p
TIME_PREFIX=^{"TimeStampString":"
Please let me know what change I need to make ?
