Here is what the last field looks like: Hope this helps.
Uncaught Exception in SilentScope: IESessionImpl:processDPCommandsEx: 0.368 Args=(Operation="306032") Vars=(Method Call Parameter Operation="306032")
EntityActivityNotifier.cpp:114:GenericContainer::EntityActivityNotifierWithTLSContext::~EntityActivityNotifierWithTLSContext(): TraceLog message 2796
|63ae678f-b640-74fc-d255-2954640f444e|2015 08 03 16:07:30:094|...... this line is a new event
So any line that does not begin with a pipe should be joined with the next line, then? That means you need a multiline filter or codec configured like this:
Thanks Magnus. The pipe delimiter on the second line in my example is actually is there b/c the first field on that line seems to be null. So, the newline does not begin with a pipe.
Here are two lines from the log. The first field is null. The second field is the guid followed by a timestamp, etc.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.