How do we edit our props.conf sourcetype configuration for proper line breaking?

[dhavamanis]

Need your help,

We want to split the event when the timestamp starts in the line, otherwise, it has to append the line with previous event:

2015-10-15 18:47:35,136 [1.2.50] [videoObjectTaskExecutor-2] ERROR o.s.batch.core.step.AbstractStep ID-ip-10-4-2-65-ec2-internal-56619-1444931577585-0-160  route3 - Encountered an error executing step videoObjectIndexStep in job bulkIndexJob
org.elasticsearch.ElasticsearchException: failure in bulk execution:
[4]: index [mavismpx-2015.10.15t18:46:05], type [video-object], id [mmvo240707651690], message [RemoteTransportException[[News Production][inet[/10.4.2.98:9300]][indices:data/write/bulk[s]]]; nested: EsRejectedExecutionException[rejected execution (queue capacity 50) on 
2015-10-15 18:48:31,130 [1.2.50] [videoObjectTaskExecutor-2] ERROR o.s.batch.core.step.AbstractStep ID-ip-10-4-2-65-ec2-internal-56619-1444931577585-0-160  route3 - Encountered an error executing step videoObjectIndexStep in job bulkIndexJob
org.elasticsearch.ElasticsearchException: failure in bulk execution:
[14]: index [mavismpx-2015.10.15t18:46:05], type [video-object], id [mmvo240707651690], message [RemoteTransportException[[News Production][inet[/10.4.2.98:9300]][indices:data/write/bulk[s]]]; nested: EsRejectedExecutionException[rejected execution (queue capacity 50) on 

Currently, we have this pattern and it's not working properly, Can you please help us to correct this?

[ingest_event]
BREAK_ONLY_BEFORE = \d\d?:\d\d:\d\d
MAX_TIMESTAMP_LOOKAHEAD = 150
NO_BINARY_CHECK = 1
pulldown_type = 1
TRUNCATE = 0

[dhavamanis · Accepted solution]

We have changed as below and its working.

[ingest_event]
BREAK_ONLY_BEFORE = ^\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d
MAX_TIMESTAMP_LOOKAHEAD = 150
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
TRUNCATE = 0