Line Breake issue

[khalidewaidah]

Could you provide me how it can write line break and Time regex below logs .

2020-09-26 19:27:33,092 DEBUG com.edifecs.shared.rmi.RMISocketFactoryInitializer - Initialize custom rmiSocketFactory...\n2014-09-26 19:27:33,983 DEBUG com.edifecs.shared.events.transport.rmi.RmiEventBusBuilder - Building EventBus instance for parameters: [eventBusID=EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}, rmiConfigurer=com.edifecs.shared.registry.RMIConfigurer@a9255c, remoteEventBusAddresses=[rmi://TEDITM01:1090/EventBus, rmi://TXENGN01:1090/EventBus, rmi://BCKCMD1:1090/EventBus], serverMode=true]\n2014-09-26 19:27:34,155 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] registered remote bus: EventBus|Web Component/TEDITM01 {5ba842c9-9310-4342-9362-e63d8a964605}\n2014-09-26 19:27:34,186 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] local bus started up\n2014-09-26 19:27:35,921 INFO com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - Failed to obtain a reference to remote EventBus. Connection to rmi://BCKCMD1:1090/EventBus refused.\n2014-09-26 19:27:35,921 DEBUG com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - java.rmi.ConnectException: Connection refused to host: BCKCMD1; nested exception is: \n java.net.ConnectException: Connection refused: connect\n2014-09-26 19:27:37,655 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] registered remote bus: EventBus|Service Manager/TEDITM01 {20f1a2e4-14d7-40e0-85b1-7462173ac1c3}

[michael_bates_1]

Hi
It is hard to tell if this should be a single event, or if it is multiple events.

Assuming this is multiple events broken on a \n followed by date, the following should work

props.conf

[ mysourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\n)\d{4}
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N