Getting Data In
Highlighted

How to configure proper line breaking for indexing ftp log files?

Engager

I have some ftp log files that I am indexing and when I search, there will be events that have 275 lines in them instead of one line which is what I want. The lines look like this:

19:00 | 00:00:28.387 | 75   -Sent-> 1004 SSH_FXP_READDIR /Outbound/SON/.
19:00 | 00:00:28.434 | 75   <-Recv- 1004 SSH_FXP_STATUS EOF(1)
19:00 | 00:00:28.434 | 75   -Sent-> 1005 SSH_FXP_CLOSE 
19:00 | 00:00:28.496 | 75   <-Recv- 1005 SSH_FXP_STATUS OK

They have a carriage return and line feed at the end of each line. I have tried the following settings in props.conf with no luck:

SHOULDLINEMERGE = false
LINE
BREAKER=[\r\n]+ (both escaped)
TIMEPREFIX = |\s (both escaped)
TIME
FORMAT = %H:%M:%S.%3N

Any ideas?

0 Karma
Highlighted

Re: How to configure proper line breaking for indexing ftp log files?

Engager

This is working now with these settings.

View solution in original post

0 Karma