Hi Team,
Need help with regex for LINE_**BREAKER** attribute in props.conf.
I have below log pattern delimited by | , however looks like this is one big event type which does not have newline or carriage return characters so i am not able to use ([\r\n]+) nor ^\w\| patterns.
Our architecture needs it and i wont be using out of box psv sourcetype.
Can someone help me provide the right LINE_BREAKER pattern to be used.
**Sample log**
hostname|cluster_name|11/26/17 00:43:19|AB- 1|INFO| Retail.getCategoryListCodesFromProperties() retail Code List to show the link ::[02756, 2127]
hostname|cluster_name|11/26/17 00:49:28|AB-No Memory|object|||||||123467|123123123|01
hostname|cluster_name|11/26/17 00:51:42|AB-No Memory|object|||||||123455|123123123|00
hostname|cluster_name|11/26/17 01:04:28|AB-No Memory|object|||||||111111|123123123|01
↧
