I've tried several different configurations and can't seem to get this to work. I have a log file like:
"3/23/2014 4:41:16 AM - Start String"
"3/23/2014 4:41:16 AM - data"
"3/23/2014 4:41:16 AM - data"
"3/23/2014 4:41:33 AM - data"
"3/23/2014 4:41:33 AM - Finished"
"3/23/2014 5:24:34 AM - Start String"
I've tried a lot of different configs here was my last try:
props.conf
[sourcetype]
SHOULD_LINEMERGE = True
BREAK_ONLY_BEFORE = Start\sString
Trying to simplify it. i previously had it BREAK_ONLY_BEFORE = regular expression date+ "start string" but it always just does one-line-per-event.
Embarassingly i didn't have the file in /etc/system/local
two things pop up here: does the sourcetype match and is your regex string on a new line?