How to group an event with multiple regular expressions to form a single event

[leandromatperei]

Hi,

I have the following log format,

How can I break this multiline event on condition that "2020-03-23 16:41:08,207" arrives.

Note that the log needs to be indexed with Local Time.

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01IS] Skipping server01 Integration Server Server, NO WinServices detected...

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01uAgentWin] APPLICATION DETECTION

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01uAgentWin] server01HM:  Release 4.1.2

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01uAgentWin] Application Type: server01 uAgent Windows

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01uAgentWin] ...On Windows: x32

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01uAgentWin] RegistryKey: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01uAgentWin] Detecting Application Instances...

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01uAgentWin] RegistryKey: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01uAgentWin] Detecting Application Instances...

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01uAgentWin] TOTAL server01 uAgent Windows Detected: 0

2020-03-23 16:41:08,207 INFO  [Thread-1] [server01uCIv8] SERVER DETECTION

[richgalloway]

1)

LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = ^
TIME_FORMAT = %Y-%d-%m %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
SHOULD_LINEMERGE = false

2)

LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = \s\|\s
TIME_FORMAT = %Y/%d/%m %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 30
SHOULD_LINEMERGE = false

3)

LINE_BREAKER = ([\r\n]+)\(\d{4}
TIME_PREFIX = \(
TIME_FORMAT = %Y/%d/%m %H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
SHOULD_LINEMERGE = false

[leandromatperei]

Two other logs I need to parse are the examples below:

2) Line break: 2020/01/21 01:47:06

INFO | jvm 1 | 2020/01/21 01:47:06 | Success -- agent is stopped!
WARN | wrapper | 2020/01/21 01:47:06 | JVM exited unexpectedly while stopping the application.
STATUS | wrapper | 2020/01/21 01:47:07 | <-- Wrapper Stopped
STATUS | wrapper | 2020/01/21 00:47:50 | --> Wrapper Started as Service

3) Line Break: 2020/03/23 10:31:00.868

(2020/03/23 10:31:00.868)(trace ) Application Error: Object reference not set to an instance of an object.

ProgressDialogsManager.ProcessState <- ProgressDialogsManager.OnLoad

(2020/03/23 11:03:08.046)(trace ) Application Error: An error occurred while communicating with the remote host. The error code is 0x80070057.

ISAPIWorkerRequestInProcForIIS6.FlushCore (*)