What if my BREAK_ONLY_BEFORE=##################################################################|(pg-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(ss7-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(ss7-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(da-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(da-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(fs-3 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(fs-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(fs-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(om-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(pg-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(om-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(mms-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(mms-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>) How do I break it into another event but still keep the regex in the event. I dont want to remove it. This is the sample raw data. I dont want to remove the top line. But I want to break just before the top line. pg-2 | CHANGED | rc=0 >> Filesystem Size Used Avail Use% Mounted on devtmpfs 16G 4.0K 16G 1% /dev tmpfs 16G 32K 16G 1% /dev/shm tmpfs 16G 1.6G 15G 11% /run tmpfs 16G 0 16G 0% /sys/fs/cgroup /dev/vda2 160G 8.4G 152G 6% / tmpfs 3.0G 168K 3.0G 1% /tmp
... View more