Why does linebreaking regex have no capturing groups?

[jackin]

Hi

Need help to fix the below error

 My Props :

Sample events:

[richgalloway]

As the message says, the LINE_BREAKER attribute must contain a capture group (a set of parenthses).  Try LINE_BREAKER = ()^\{

You only need to specify LINE_BREAKER once in a stanza.

[jackin]

Thanks for reply @richgalloway 

When applying a linebreaker, all logs fall under a single line.

It is showing like Failed to parse timestamp Defaulting to file modtime

[richgalloway]

Failing to parse timestamps is a different problem.  Please post a new question so this one can focus on the line breaking problem.

What do you mean by "all logs fall under a single line"?  The sample events appear to be multi-line.

[jackin]

Hi

after using the below props configuration , the same error as mentioned above is coming ..

SHOULD_LINEMERGE=false
LINE BREAKER=([\r\n]+){
NO BINARY CHECK-true
BREAK ONLY_BEFORE=^\{
CHARSET=UTF-8
disabled=false
KV MODE=json
MAX TIMESTAMP LOOKAHEAD=70
TIME PREFIX="(timeStamplevtime)"\s*: \s*"
TIME FORMAT=%Y-%m-%dT%I:%M:%S
TRUNCATE=999999

[richgalloway]

Remove the BREAK_ONLY_BEFORE setting.

[jackin]

If I remove it. Logs are not breaking properly.

[richgalloway]

You shouldn't have both BREAK_ONLY_BEFORE and LINE_BREAKER in the same stanza.  Choose one or the other.  If you don't use LINE_BREAKER then SHOULD_LINEMERGE should be set to true.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Data/Configureeventlinebreaking for details.