Is it possible to tell LINE_BREAKER to stop eating my angle bracket?

[hulahoop]

The use of LINE_BREAKER is a bit cryptic to me... ok, a lot. But I think I've managed to figure out how to break my XML elements into events... sorta.

Here's a data sample:

<Exception><Description>some ugly exception</Description><StackTrace>woah</StackTrace></Exception><Exception><Description>another ugly exception</Description><StackTrace>lots of stuff</StackTrace></Exception>

With this config in props.conf:

[foo]
SHOULD_LINEMERGE = false
LINE_BREAKER = ()<Exception>

Since the <Exception> elements do not appear on a new line, it seems LINE_BREAKER is my only option in props.conf to specify where to make a new event. The trouble is LINE_BREAKER requires at least 1 matching group, and the contents of the matching group do not appear in the event. The rule above effectively eats the opening bracket, such that events appear like this in Splunk:

Exception><Description>some ugly exception</Description><StackTrace>woah</StackTrace></Exception>
Exception><Description>another ugly exception</Description><StackTrace>lots of stuff</StackTrace></Exception>

How disgusting. Is there some regex magic to put the < back in Exception>?

[115547873038911]

Try starting the regex with ([\n\r]). From the spec "* The contents of the first matching group is ignored as event text."

[gkanapathy]

Unfortunately the events don't have newlines or CR between them, so we can't use them to find the breaks. What we're doing is a regex lookahead, which is supposed to basically match the following characters without actually including them as part of the match.

[gkanapathy · Accepted solution]

Try a regex lookahead:

LINEBREAKER = ((?=\<Exception\>))

Update: per comments, the above doesn't work, but this does:

LINEBREAKER = [\>\s]((?=\<Exception\>))

[hulahoop]

hallelujah! the last suggestion works like a charm! Thank you, G!

[gkanapathy]

Seems like a bug to me. Might try >\s as a last resort.

[hulahoop]

Still ate the opening angle bracket. 😞