I am trying to break these into separate events and have tried everything and its just not working
< sale id="1012128864" reportGroup="asdasd" customerId="7412213255" > < orderId>101221348864 < /orderId > < amount>1999 < /amount > < orderSource >ecommerce < /orderSource > < token > <litleToken >8888888888888 < /litleToken > < expDate >1120 < /expDate > < /token > < / sale >
[custom_sourcetype] BREAK_ONLY_BEFORE_DATE = false BREAK_ONLY_BEFORE = \ SHOULD_LINEMERGE = true
This works for me with your sample data.
[custom_sourcetype] BREAK_ONLY_BEFORE = \<\s*sale\s MUST_BREAK_AFTER = \<\s*/sale\s*\> BREAK_ONLY_BEFORE_DATE = false DATETIME_CONFIG = CURRENT NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = true pulldown_type = 1
The only thing that overrides etc/system/local would be if you're using a clustered indexing setup, with custom rules pushed by the cluster master to the indexer peers. So unless you're in a cluster, system/local/props.conf is the king of the hill.