Cannot break event by log from syslog

[riposans]

Dear Everyone

can help me for this, i have log from syslog but cannot break event by lines.

{"@timestamp":"2000-01-21T00:58:39.372418529Z","event":{},"@version":"1","type":"prod","filtered_message":"[ABC]|Type=ABC|logDate=2000-01-21 00:58:39|ABC1=ABC2|ABC12=ABC23|ABC34=ABC35|ABC45=ABC46"}{"@timestamp":"2000-02-21T00:58:39.372418529Z","event":{},"@version":"1","type":"prod","filtered_message":"[ABC]|Type=ABC|logDate=2000-02-21 00:58:39|ABC1=ABC5|ABC13=ABC24|ABC35=ABC36|ABC46=ABC47"}

i need break this log from props.conf, i already used this:

[ABC]

LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false

but not works, please tell me how to extract event log by lines

[tscroggins]

Hi @riposans,

The text doesn't appear to be syslog (see RFC 3164 and RFC 5424). Is this a raw TCP or UDP stream? You may want to try:

[ABC]
SHOULD_LINEMERGE = false
LINE_BREAKER = ()\{"@timestamp"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%9Q%Z
TIME_PREFIX = {"@timestamp":"
MAX_TIMESTAMP_LOOKAHEAD = 30
# for events IN THE YEAR 2000 (thanks, Conan!)
MAX_DAYS_AGO = 10000