so I have a case where my line breaks are fine in the Director.log
but in Director.log.20100517 00-20-29##20.log
they don't get applied.
What's interesting is the get the right source type from the props.conf (in the deployed app)
[source::...Director.log...]
sourcetype = rs_director
and that stanza should take care of it..
the in props.conf of the local app on the indexer, i have this:
[rs_director]
BREAK_ONLY_BEFORE=^\d+-\d+-\d+\s+\d+:\d+:\d+.\d+:
pulldown_type = true
AUTO_TAG = false
KV_MODE = none
MAX_TIMESTAMP_LOOKAHEAD = 25
MAX_EVENTS = 512
AUTO_LINEMERGE = false
TIME_FORMAT = %m-%d-%y %H:%M:%S
TZ = EST-5EDT,M3.2.0,M11.1.0
but it doesn't break the old logs (the regex works fine in the base log)..
