Line Breaking without removing field

[willcwhite]

In my props.conf, I have LINE_BREAKER=field1 this breaks the events how I want but it removes field1 from every event. Is there any way to keep field1 in my events but still break events after it occurs?

Thanks in advance

[richgalloway · Accepted solution]

The LINE_BREAKER setting breaks events at the first capture group in the regex and discards that regex. To avoid discarding important data, use an empty capture group.

LINE_BREAKER = field1()

[Azwaliyana]

What if my BREAK_ONLY_BEFORE=##################################################################|(pg-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(ss7-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(ss7-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(da-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(da-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(fs-3 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(fs-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(fs-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(om-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(pg-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(om-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(mms-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(mms-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)

How do I break it into another event but still keep the regex in the event. I dont want to remove it. This is the sample raw data. I dont want to remove the top line. But I want to break just before the top line.

pg-2 | CHANGED | rc=0 >>
Filesystem Size Used Avail Use% Mounted on
devtmpfs 16G 4.0K 16G 1% /dev
tmpfs 16G 32K 16G 1% /dev/shm
tmpfs 16G 1.6G 15G 11% /run
tmpfs 16G 0 16G 0% /sys/fs/cgroup
/dev/vda2 160G 8.4G 152G 6% /
tmpfs 3.0G 168K 3.0G 1% /tmp