EventDelimiter
22 August 2024
ID 198872
Specifies the rule for the splitting of incoming events.
Path
InputSettings
> EventDelimiter
Attributes
This element has no attributes.
Value
The value rule must have the following format:
<EventDelimiter>%START_EVENT_SYMBOLS%</EventDelimiter>
The %START_EVENT_SYMBOLS%
value contains the regular expression that corresponds to the beginning of the substring of the incoming event.
The rule processes all occurrences of the %START_EVENT_SYMBOLS%
value. If the %START_EVENT_SYMBOLS%
value is found in the string of the incoming event, this string will be split into multiple events by the addition of the newline character (\n
) before every matched substring.
If the %START_EVENT_SYMBOLS%
value does not match any substring of the incoming string, the incoming string is considered a single event.
If an event contains newline characters (\n
), such an event will be split by using both the %START_EVENT_SYMBOLS%
value and newline characters as event delimiters.
Example
The following is an example of this element.
<EventDelimiter><![CDATA[;]]></EventDelimiter> |