Breaks need to be placed in the props.conf. I assume in your inputs.conf your forcing the sourcetype to iss? If so, inputs.conf [script://blah.exe] sourcetype = iis props.conf [iis] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = Date BREAK_ONLY_BEFORE = ###_End_Of_Mail_Message_### you can also do this by the source as well, props.conf [source::Email] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = Date BREAK_ONLY_BEFORE = ###_End_Of_Mail_Message_### That being said, you can only use 1 break_only_before block. If you want to do "or" type clauses, use the "|" delimiter (Date)|(###_End_Of_Mail_Message_###) or did you mean to type: BREAK_ONLY_AFTER = ###_End_Of_Mail_Message_### ... View more