Line breaking not working with rolling log files

[bishtk]

Log file name : run_xxxxxxx_XXX_XXXXXX_XXX.log.04020830

This is the log file name and its suffix always ends with current date. So it gets rolled everyday into a new file with new date.
For this I have added crcSalt in inputs.conf file.

Pasted below is the log event format. Where "beginning" line is the start of event and "ending" line is the end of event. This is one complete event
23:30:05 =================/XXX/XXXXXX/run_XXX.ksh beginning=================
**
23:30:15 =================/XXX/XXXXXX/run_XXX.ksh ending====================

For this I have applied below parsing under props.conf of heavyforwarder
[source::/XXX/XXXXXX/XXX/XXX/.log.]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = ^\d{1,2}:\d{1,2}:\d{1,3}\s.*\sbeginning

This parsing is working when I tested the same on local machine or test environment with single log file. But in production, since there it creates a rolling log file everyday, this line breaking is not working.

Please suggest?

Thanks in advance

[kamlesh_vaghela]

@kundanbisht

Have you tried with this? I have just added *.

[source::/XXX/XXXXXX/XXX/XXX/.log.*]

[bishtk]

Hi @kamlesh_vaghela these pre-requisites/basic steps are already in place (although i missed that in description). What I am looking for here is that even after all those steps, breaking is not happening properly.
And I am doubting the cause behind it is rolling log file. So need to know if any specific step or variable is there to add for this rolling log file line parsing?

[bishtk]

Any expert advice splunkers?