Goal is to parse new events based on this source value into multiline events split each time a new date is encountered.
Currently the events are not splitting correctly based on the date, as well as the AM/PM not being discovered causing all of the morning and afternoon data to overlap in the first 12 hours of the _time field.
Time stamp from log
<31-Mar-2021 3:18:04 o'clock AM MDT> <Error> <Default>
[source::/fmw/product/.../servers/logs/domain-1.out]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = <\d+-\w+
TIME_PREFIX = <
TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z
MAX_TIMESTAMP_LOOKAHEAD = 40
[source::/fmw/product/.../servers/logs/domain-2.out]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = <\d+-\w+
TIME_PREFIX = <
TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z
MAX_TIMESTAMP_LOOKAHEAD = 40
Try these settings. Perhaps most important is escaping the < in a regex.
SHOULD_LINEMERGE = false
TIME_PREFIX = \<
TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z
MAX_TIMESTAMP_LOOKAHEAD = 40
LINE_BREAKER = ([\r\n]+)\<\d+-
Try these settings. Perhaps most important is escaping the < in a regex.
SHOULD_LINEMERGE = false
TIME_PREFIX = \<
TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z
MAX_TIMESTAMP_LOOKAHEAD = 40
LINE_BREAKER = ([\r\n]+)\<\d+-