I want my logs to be indexed as follows:
EVENT-1 THIS IS SOME LINE
New line 1
New line 2
New line 3
New line ..
New line ..
New line 21 
EVENT-2 THIS IS SOME LINE
New line 1
New line 2
New line 3
New line ..
New line ..
New line 21 
But they get Indexed like:
EVENT-1 THIS IS SOME LINE
New line 1
New line 2
New line 3
EVENT-2 
New line ..
New line ..
New line 21 
EVENT-3 THIS IS SOME LINE
New line 1
New line 2
New line 3
EVENT-4 
New line ..
New line ..
New line 21 
Basically its giving a LINE BREAK after a fixed set of lines instead of what I have configured in props.conf.
How can I increase the number of lines/events that can be grouped together in one event ?
I used the following props.conf
[punchout]
   SHOULD_LINEMERGE = true
   LINE_BREAKER = ([\r\n]+)\[\w+\]\s\[\d{1,2}\/\d{1,2}\/\d{1,4}\s\d{1,2}:\d{1,2}:\d{1,2}:\d{1,3}\].+UserCreateAndEditTask\sprocessRequest\smethod\sstarted
   TIME_FORMAT =%m/%d/%Y %H:%M:%S:%3N
   MAX_TIMESTAMP_LOOKAHEAD = 25
   TIME_PREFIX = \[
   TRUNCATE = 0
   MAX_EVENTS = 20000 
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		Hi  joydeep741,
can you identify the LINE BREAKER REGEX? the one you showed isn't so clear and the only one.
can you share an example of your logs?
Bye.
Giuseppe
