How to merge multiline messages to one event

[akanno]

Hi,splunkers

We want to index multiline log messages with no timestamp as one event.

But regular expression for multiline is difficult.

So now I try following configurations.

[source::/opt/mail1.log]

SHOULD_LINEMERGE = true

MAX_EVENTS=200

LINE_BREAKER = XXXXXXXXXXXXX

TRUNCATE = 50000

But it does not work.

first event is 200 lines messages event but next event is 1 line messages event.

I want to 200 lines messages per one event.

Is there any idea?

thank you for my help,

[lguinn2 · Accepted solution]

Try this

[source::/opt/mail1.log]
SHOULD_LINEMERGE = true
MAX_EVENTS=200
BREAK_ONLY_BEFORE=XXXXXXXXXXXX
TRUNCATE = 50000
DATETIME_CONFIG = NONE

[akanno]

Sorry,
Mistake made by me.
This answer is good.
Thank you very much for lguinn ♦ .

[akanno]

inputs.conf is on universal forwarder for this input
props.conf is on indexer

[lguinn2]

So both your inputs.conf and your props.conf are on the indexer for this input?

[akanno]

It is on a indexer

[lguinn2]

Next question: where is your input? Is it on a forwarder? A universal forwarder or a heavy forwarder?

Where is your props.conf?

[akanno]

I tried this answer but I had the same result

[akanno]

Hi,lguinn ♦ thank you for comment
Assumed log is continuous with same messages
For example
Rejected at IN(default) filter: TCP
Rejected at IN(default) filter: TCP
Rejected at IN(default) filter: TCP

[lguinn2]

We need to see an example of your data. This is not enough information!