Swinging back around to an issue that has me a bit confused. Microsoft DHCP Failover Auto Config Sync generates logs like the following:
==================================================================================================
Sync process complete at 01/25/2018 17:04:08.
Sync process complete at 01/25/2018 17:11:16.
Periodic Sync TimeOut Happened:
Syncing Relation:DHCP1-DHCP2
Sync process complete at 01/25/2018 17:26:17.
I've created a custom source type, shown below:
[dfacs]
TRUNCATE = 999999
LINE_BREAKER = (=+[\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD=22
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
TIME_FORMAT=%m/%d/%Y %H:%M:%S
TIME_PREFIX=Sync\sprocess\scomplete\sat\s
TZ=US/Eastern
disabled=false
My main frustration is that, for some reason, it separates the following the 3-line section into 2 events with EVENT1 being given a timestamp ~ 3 seconds before EVENT2 is properly timestamped:
Periodic Sync TimeOut Happened:
Syncing Relation:DHCP1-DHCP2
Sync process complete at 01/22/2018 11:37:02.
--EVENT1--
Periodic Sync TimeOut Happened:
Syncing Relation:DHCP1-DHCP2
--EVENT2--
Sync process complete at 01/22/2018 11:37:02.
Based on the props, I did intend to remove the lines with "="'s. As the 2-line events break fine, any suggestions on how to stop the 3-line events from breaking?
can you try SHOULD_LINEMERGE=true in your stanza else try:-
[dfacs]
LINE_BREAKER = (====+)
MAX_TIMESTAMP_LOOKAHEAD=22
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=true
TIME_FORMAT=%m/%d/%Y %H:%M:%S
TIME_PREFIX=Sync\sprocess\scomplete\sat\s
TZ=US/Eastern
disabled=false
and after changing props.conf change will affect later indexed events and it will not affect already indexed events.