Why is must_break_after configuration not working?

[mjones414]

I have a large (10's of thousands of lines) data stream that runs every 10 minutes and I want it to break after this line:

sharing = default_shared

I tried putting in:

MUST_BREAK_AFTER = (sharing = default_shared)

But this did not work.

I was hoping it would take the literal string, but it's not working.

[somesoni2 · Accepted solution]

Try something like this

[yoursourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER= ([\r\n]+)(?=sharing\s*=\s*default_shared)
... other configs....

[mjones414]

Worked like a champ!! Thanks so much!