Hello All,
i have source with events
****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:01:30
Partition not defined for this node:
****4062182208*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:01
Partition not defined for this node:
****4062182208*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:01
Partition not defined for this node:
****4059036480*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4059036480*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00
Partition not defined for this node:
****4029676352*vwxmsghdlr.cpp*03523*08000*2020DEC22*13:58:54
Partition not defined for this node:
can someone help me in writing TIME_PREFIX and LINE_BREAKER?
Try these settings.
[mysourcetype]
LINE_BREAKER = ([\r\n])\*{4}
SHOULD_LINEMERGE = false
TIME_PREFIX = \*\d{5}\*\d{5}\*
TIME_FORMAT = %Y%b%d*%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 18
Try these settings.
[mysourcetype]
LINE_BREAKER = ([\r\n])\*{4}
SHOULD_LINEMERGE = false
TIME_PREFIX = \*\d{5}\*\d{5}\*
TIME_FORMAT = %Y%b%d*%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 18