We have a tcp input that is merginging lines when they come in too fast.
I have (inputs)
[tcp://5140]
connection_host = dns
sourcetype=apigee
source=tcp:5140
index=apigee
I tried putting into props.conf the following info:
[apigee]
SHOULD_LINEMERGE = false
But this doesn't seem to work.
Is there a way to force this to always break on newlines - alternately, I could regex to break BEFORE the <11>?
here is an example that is munged:
<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/NPLUSBASKETBALL, target_path=/api/me/sport/activities/NPLUSBASKETBALL, client_id = 080a157bac0b57fd4a05073635652a4c, forwarded_for_ip = 72.37.244.124, response_code = 500, total_response_time = 147, target_response_time = 52, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852510996, client_request_end_time_stamp = 1375852510997, target_request_start_time_stamp = 1375852511090, target_request_end_time_stamp = 1375852511090, client_response_time_stamp = 1375852511143, client_response_end_time_stamp = 1375852511143, target_response_start_timestamp = 1375852511142, target_response_end_timestamp = 1375852511142
<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/Running, target_path=/api/me/sport/activities/Running, client_id = 080a157bac0b57fd4a05073635652a4c, forwarded_for_ip = 72.37.244.124, response_code = 200, total_response_time = 243, target_response_time = 93, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852514060, client_request_end_time_stamp = 1375852514061, target_request_start_time_stamp = 1375852514210, target_request_end_time_stamp = 1375852514210, client_response_time_stamp = 1375852514303, client_response_end_time_stamp = 1375852514303, target_response_start_timestamp = 1375852514303, target_response_end_timestamp = 1375852514303
<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/NPLUSKINECTTRG, target_path=/api/me/sport/activities/NPLUSKINECTTRG, client_id = 080a157bac0b57fd4a05073635652a4c, forwarded_for_ip = 72.37.244.124, response_code = 500, total_response_time = 67, target_response_time = 28, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852516029, client_request_end_time_stamp = 1375852516029, target_request_start_time_stamp = 1375852516068, target_request_end_time_stamp = 1375852516068, client_response_time_stamp = 1375852516096, client_response_end_time_stamp = 1375852516096, target_response_start_timestamp = 1375852516091, target_response_end_timestamp = 1375852516096
<11> : [Alert.CRIT] : APIGEE : service = Nike_Plus, path = /me/sport/activities/NPLUSTRG, target_path=/api/me/sport/activities/NPLUSTRG, client_id = 080a157bac0b57fd4a05073635652a4c, forwarded_for_ip = 72.37.244.124, response_code = 500, total_response_time = 157, target_response_time = 69, rate_limit_exceed = false, response_cache_hit = false, client_request_start_time_stamp = 1375852518106, client_request_end_time_stamp = 1375852518107, target_request_start_time_stamp = 1375852518194, target_request_end_time_stamp = 1375852518194, client_response_time_stamp = 1375852518263, client_response_end_time_stamp = 1375852518263, target_response_start_timestamp = 1375852518263, target_response_end_timestamp = 1375852518263
