forwarder logs different type from the indexer.

[lifekis]

I want to use forwarder to forward mail logs to indexer.
However, the log forwarded from the forwarder is displayed separately from the indexer.
how can i solve it.

start character: MAIL_LOG
end character: END_MAIL

[[[forwarder log file]]]
ex1) The forwarder log file looks like this:
MAIL_LOG
date:2019-00-00 00:00:00
subject: abcdefg
from: abc@abc.com
to:abcd@abcd.com
size:12345
content:afafa
...
END_MAIL

[[[indexer]]]
The log is divided.

ex1) only mail start characters logs.
MAIL_LOG

ex2) only part of the message logs.
content:afafa

ex3) Do not include the mail start character logs. MAIL_LOG
date:2019-00-00 00:00:00
subject: abcdefg
from: abc@abc.com
to:abcd@abcd.com
size:12345

[gaurav_maniar]

provide the screenshot of the log file and the same data in Splunk.
I think, the issue is because of sourcetype configuration for multiline event.

[richgalloway]

Please explain more about what you mean by "the log forwarded from the forwarder is displayed separately from the indexer". Use actual example events, but hide private information.

[lifekis]

The forwarder can check the log file in full format. However, the log is truncated on the indexer.

[richgalloway]

Your props.conf settings probably need to be adjusted. Please provide some sample events and we'll try to help you get the settings right.