Hi,
How to use line breaking to break events before TBD, new event starts with TBD.
sample data:
ABC*11*231~
CFFGBPR*DD*1212*Ddf*12333~
TBD*1*3234454*12223355~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
TBD*1*wewe*2344~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
required output:
event 1
TBD*1*3234454*12223355~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
event 2
TBD*1*wewe*2344~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
I tried below stanza, it dint work. Any suggestions?
[ ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=TBD
CHARSET=UTF-8
disabled=false
Hi @knalla,
Your config works for me, but try this :
[yoursourcetype]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
LINE_BREAKER=(\r|\n)TBD
You can test it out in the gui using add data.
Cheers,
David
Hi @knalla,
Your config works for me, but try this :
[yoursourcetype]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
LINE_BREAKER=(\r|\n)TBD
You can test it out in the gui using add data.
Cheers,
David
Its working, but its not breaking events if the event start with TBD.