Boundary Regex for multiline processing

Comments

1 comment

  • Official comment
    Avatar
    Jorge Silva

    Hello Rahul,

    What you are trying to do is not possible in Sumo Logic. A boundary regex works by defining the entire first line of a message. For this to work there has to be line breaks between each line of a message. 

    It looks that what you are trying to do is to split a single-line JSON message into multiple JSON messages. This is not possible. 

    The solution for this would be to send each message individually to Sumo Logic. You could also parse each JSON individually in a query search using the multi option of parse regex, then you can work with each separate message, but this is done in a query instead during ingestion. For more information about parse regex, please go to https://help.sumologic.com/05Search/Search-Query-Language/01-Parse-Operators/02-Parse-Variable-Patterns-Using-Regex.

    Best regards,

    Jorge

    Comment actions Permalink

Please sign in to leave a comment.