How do you Join or Merge multiple events at index time based on a common field?

[ncmouli]

I'm looking for a method to merge events based on a common field at index time, not at search time, and I've have already used LINE_BREAKER in props.conf to join the events with regex pattern of events. However, it does not seem to be working only if the events being ingested with delay.

Can someone please suggest if any supported attribute like LINE_BREAKER in Props or any other alternative which helps us to join the events though ingested with delay.

Thanks much for your response!

[MuS]

Hi there, can you please share some sample events (remove all private informations first!) and the expected result? Without these information it will be very difficult to provide help.

cheers, MuS