Hello

A file has a certain set of fields, as in the example below. These events are combined into small groups of 3-4 events (they are united by a common theme), and there is a gap between these groups for visibility.

As far as I know, the connector treats anything starting with a newline as a new message when processing the file.

I need to process a group of 3-4 events as one big event. But because they start with a new line, the connector treats them as separate messages and in that case the regular expression does not work.

Is it possible to solve this situation? There is no possibility to change the method of saving events in the file !!!

CEF:0|SecurityVendor|SecurityProduct|1.0|100|Login Successful|5|suser=john_doe src=192.168.1.10 msg=User john_doe logged in
CEF:0|SecurityVendor|SecurityProduct|1.0|101|Login Failed|3|src=192.168.1.11 dst=192.168.1.1 msg=Failed login attempt from 192.168.1.11
CEF:0|SecurityVendor|SecurityProduct|1.0|200|Malware Alert|8|fileHash=5d41402abc4b2a76b9719d911017c592 dst=192.168.1.2 msg=Malware detected
CEF:0|SecurityVendor|SecurityProduct|1.0|300|Firewall Rule Change|6|suser=admin rule=AllowAllToDenyAll msg=Firewall rule changed

CEF:0|SecurityVendor|SecurityProduct|1.0|100|Login Successful|5|suser=john_doe src=192.168.1.10 msg=User john_doe logged in
CEF:0|SecurityVendor|SecurityProduct|1.0|101|Login Failed|3|src=192.168.1.11 dst=192.168.1.1 msg=Failed login attempt from 192.168.1.11
CEF:0|SecurityVendor|SecurityProduct|1.0|200|Malware Alert|8|fileHash=5d41402abc4b2a76b9719d911017c592 dst=192.168.1.2 msg=Malware detected
CEF:0|SecurityVendor|SecurityProduct|1.0|300|Firewall Rule Change|6|suser=admin rule=AllowAllToDenyAll msg=Firewall rule changed

CEF:0|SecurityVendor|SecurityProduct|1.0|100|Login Successful|5|suser=john_doe src=192.168.1.10 msg=User john_doe logged in
CEF:0|SecurityVendor|SecurityProduct|1.0|101|Login Failed|3|src=192.168.1.11 dst=192.168.1.1 msg=Failed login attempt from 192.168.1.11
CEF:0|SecurityVendor|SecurityProduct|1.0|200|Malware Alert|8|fileHash=5d41402abc4b2a76b9719d911017c592 dst=192.168.1.2 msg=Malware detected
CEF:0|SecurityVendor|SecurityProduct|1.0|300|Firewall Rule Change|6|suser=admin rule=AllowAllToDenyAll msg=Firewall rule changed

Thanks in advance.

Bohdan