how to use source stanza in props.conf with spefic regex?

[rajasekhar14]

i'm trying yo use below source stanza in props.conf file to break the events.

my source pattern will be ""xxx/messeages or performance/345/345/xxxxx.blob"" can you guys please help with this PCRE?

after the regex i will use below settings
[source::]
sourcetype = Json
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = { messages

Thanks,
Raj

[jnudell_2]

Hi @rajasekhar14 ,

It's not straight PCRE, it includes the path translations as specified in the props.conf documentation.
You could use something like:

[source::.../(messages|performance)/345/345/*.blob]

sourcetype = json

SHOULD_LINEMERGE = false

LINE_BREAKER = ([\r\n]+){\s*messages

I would recommend using SHOULD_LINEMERGE = false & LINE_BREAKER instead of BREAK_ONLY_BEFORE.

See if that works for you.

[nplamondon]

What have you tried? Where are you getting stuck?