I'm trying to develop a regex to separate merged events from a log. Here's my stanza in props.conf:
[source=c:\temp\nagios*-perfdata]
SHOULD_LINEMERGE = true
LINE_BREAKER = ([\r\n]+)
BREAK_ONLY_BEFORE = ^DATATYPE::
I've tried various regex's for BREAK_ONLY_BEFORE, all of which work in my regex tester.
Don't think I really need LINE_BRAKER, but have tried with and without.
Any help would be appreciated.
[source=path]
, it should be [source::path]
.\
(backslash) in paths must be escaped, so: [source::c:\\temp\\nagios-perfdata]
[source::(?i)c:\\temp\nagios*-perfdata]
#
except at the beginning of a line, i.e., if the comment with # tried with and without...
are actually in your config file on the same line as LINE_BREAKER = ([\r\n]+)
, what you think is a comment is taken as part of the line breaker regex.[source=path]
, it should be [source::path]
.\
(backslash) in paths must be escaped, so: [source::c:\\temp\\nagios-perfdata]
[source::(?i)c:\\temp\nagios*-perfdata]
#
except at the beginning of a line, i.e., if the comment with # tried with and without...
are actually in your config file on the same line as LINE_BREAKER = ([\r\n]+)
, what you think is a comment is taken as part of the line breaker regex.Thanks. That got it working on my test instance on Windows, so I moved it to the production Linux box and it's working great!