Refine your search:

Single events are combined into multi-line events

0

Hello,

I have a log file that is being indexed and many of the lines show up combined into multi-line events however there seems to be no logic behind the combining. Each line has a timestamp yet they are being combined regardless. I have no props.conf in this config - therefore I assume default line merging is in effect.

Example log data:

08:26:53,465 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap

08:26:53,561 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap

08:26:53,699 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap

08:26:53,765 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap

08:26:59,234 WARN [org.alfresco.repo.cache.TransactionalCache.org.alfresco.cache.avmNodeTransactionalCache] Transactional update cache 'org.alfresco.cache.avmNodeTransactionalCache' is full (5000).

08:27:05,532 WARN [org.alfresco.repo.cache.TransactionalCache.org.alfresco.cache.contentDataTransactionalCache] Transactional update cache 'org.alfresco.cache.contentDataTransactionalCache' is full (1000).

08:27:23,223 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap

08:27:23,961 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap

08:27:23,962 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'OOoDirect' subsystem, ID: [OOoDirect, default]

08:27:23,988 INFO [org.alfresco.config.FixedPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/version.properties]

Result

The result is some of the lines are combined to multi-line and some are not but I cannot distinguish what is causing the combining/breaking.

Question

Is it possible to configure a regex to recognize the timestamp on the new line and then use props.conf to further configure the line breaking?

Thanks, John

asked 07 Jun '11, 06:32

frankejj's gravatar image

frankejj
56●1●6
accept rate: 0%

2 Answers:
oldestnewestmost voted
0

Probably an issue with the timestamps. See if this helps:

# props.conf
[my_sourcetype]
SHOULD_LINEMERGE = false
TIME_FORMAT = %H:%M:%S,%n
link

answered 07 Jun '11, 06:49

mw's gravatar image

mw
1.7k●2●15
accept rate: 29%

0

Thanks! Setting the time format did the trick. I did not change line merge to false because there are also many multi-line entries in these logs.

link

answered 13 Jun '11, 04:42

frankejj's gravatar image

frankejj
56●1●6
accept rate: 0%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

learn more about Markdown

Tags:

×94

Asked: 07 Jun '11, 06:32

Seen: 1,627 times

Last updated: 13 Jun '11, 04:42

Related questions

Split multi-line events

Multi Line Events "truncate"

multiline event breaking issue

Access logs events showing in single line instead of multiline

Some Single Line Messages Are Merged into a Single Event

multi line event, break with a empty line

Multiple events get aggregated into a single event

Insert image into single event with provided URL

A few events from a single log source file are getting stuck together at indexing - why?

Copyright © 2005-2012 Splunk Inc. All rights reserved.