I am wondering about the xml payload aspect of it in my sample log I have two events each with an event def (ending in pipe) followed by a xml payload which can be 5 lines to maybe 50 lines max
does the line break on | and the line merge take care of having all of the xml payload in the same event"
Hi rileyken,
set in your props.conf for that sourcetype something like this:
LINE_BREAKER = \|
Maybe you also need to set
SHOULD_LINEMERGE = [true|false]
* Defaults to true.
to false.....
hope this helps ...
cheers, MuS