Why is LINE_BREAKER not working?

[fitzgej_entrust]

I'm having some issues getting my LINE_BREAKER configuration to work for a custom log file. I've tested the RegEx and it matches the beginning of every line, however it's still breaking extremely strangely. Here's the configuration we're running as well as a sample of the log.

The screenshot at the bottom is what it's actually doing.

MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %Y-%m-%d_%I%M %p
TIME_PREFIX = ^
TZ = MST
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\d{4}-\d{2}-\d{2}_\d{4} [A|P]M[\s\r\n]+\d{2}


---


2022-05-10_1120 AM 
10.12.14.3 
HSM device 0:	HSM in NORMAL MODE. RESPONDING. Usage Level=0%
2022-05-10_1120 AM 
10.12.14.4 
HSM device 0:	HSM in NORMAL MODE. RESPONDING. Usage Level=0%
2022-05-10_1120 AM 
10.12.14.5 
HSM device 0:	HSM in NORMAL MODE. RESPONDING. Usage Level=0%
2022-05-10_1120 AM 
10.12.14.81 
HSM device 0:	HSM in NORMAL MODE. RESPONDING. Usage Level=58%
2022-05-10_1120 AM 
10.12.14.82 
HSM device 0:	HSM in NORMAL MODE. RESPONDING. Usage Level=73%
2022-05-10_1120 AM 
10.12.14.88 
HSM device 0:	HSM in NORMAL MODE. RESPONDING. Usage Level=0%
2022-05-10_1120 AM 
10.12.14.91 
HSM device 0:	HSM in NORMAL MODE. RESPONDING. Usage Level=0%

[somesoni2 · Accepted solution]

Give this a try

On your indexer/heavy forwarder (whichever comes first)

[yourSourceType]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\d{4}-\d{2}-\d{2}_\d{4} [A|P]M)
MAX_TIMESTAMP_LOOKAHEAD = 18
TIME_FORMAT = %Y-%m-%d_%I%M %p
TIME_PREFIX = ^
TZ = MST

[fitzgej_entrust]

...I can not believe I was trying to run that on the Universal forwarder. Worked like a charm, and thank you for the catch there.