mspiegle, I'm not sure how to match the timezone offset with the colon in it. You've used %:z, though the link that you posted mentions only %z, %::z and %:::z. I've used %z (which matches offsets like +0400), but not the others. It may work as you've got it if the events were linebreaking properly. You might want to try this in your props.conf stanza: LINE_BREAKER = ([\r\n]+)(?\d{4}-\d{2}-\d{2}T) Assuming you keep the same date format. And I'd throw that MAX_TIMESTAMP_LOOKAHEAD back to 25, but that's just the OCD personality in me speaking... 🙂 ... View more