I'm looking for a method to merge events based on a common field at index time, not at search time, and I've have already used LINE_BREAKER in props.conf to join the events with regex pattern of events. However, it does not seem to be working only if the events being ingested with delay.
Can someone please suggest if any supported attribute like LINE_BREAKER in Props or any other alternative which helps us to join the events though ingested with delay.
Thanks much for your response!
... View more