i'm trying yo use below source stanza in props.conf file to break the events.
my source pattern will be ""xxx/messeages or performance/345/345/xxxxx.blob"" can you guys please help with this PCRE?
after the regex i will use below settings
[source::]
sourcetype = Json
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = { messages
Thanks,
Raj
Hi @rajasekhar14 ,
It's not straight PCRE, it includes the path translations as specified in the props.conf documentation.
You could use something like:
[source::.../(messages|performance)/345/345/*.blob]
sourcetype = json
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+){\s*messages
I would recommend using SHOULD_LINEMERGE = false & LINE_BREAKER instead of BREAK_ONLY_BEFORE.
See if that works for you.
What have you tried? Where are you getting stuck?