The Timestamp Event Breaker is a low-configuration method to break events at the start of any line where Cribl Stream detects a valid timestamp.

Use this Event Breaker for:

• Log streams that use non-standard or highly varied timestamp formats where writing a single, complex regex would be difficult or inefficient.
• Multi-line logs (like application stack traces) where every new event begins with a timestamp, but the exact format isn’t guaranteed or known ahead of time.

While highly flexible, the Timestamp Breaker may have a slight performance trade-off compared to a precise Regex Breaker because it requires more processing to dynamically detect the timestamp pattern. For maximum precision and performance on known log formats, use a Regex Event Breaker with a positive lookahead instead.

See Event Breakers for general information about event breakers.

Settings

​

The Timestamp Event Breaker is useful as an out of the box Event Breaker for event segmentation:

• There is no field to input a regex or pattern.
• A new event is defined when Cribl Stream identifies a valid time value at the beginning of a line.

Configuration Example

​

The following is an example of data input before the Timestamp Event Breaker processes it:

{"level":"debug","ts":"2021-02-02T10:38:46.365Z","caller":"sdk/sync.go:42","msg":"Handle ENIConfig Add/Update: us-west-2a, [sg-426fdac8e5c22542], subnet-42658cf14a98b42"}
{"level":"debug","ts":"2021-02-02T10:38:56.365Z","caller":"sdk/sync.go:42","msg":"Handle ENIConfig Add/Update: us-west-2a, [sg-426fdac8e5c22542], subnet-42658cf14a98b42"}

Output

​

From the example raw data, the Timestamp Event Breaker would generate two output events:

{
  "_raw": "{\"level\":\"debug\",\"ts\":\"2021-02-02T10:38:46.365Z\",\"caller\":\"sdk/sync.go:42\",\"msg\":\"Handle ENIConfig Add/Update: us-west-2a, [sg-426fdac8e5c22542], subnet-42658cf14a98b42\"}",
  "_time": 1612262326.365
}
{
  "_raw": "{\"level\":\"debug\",\"ts\":\"2021-02-02T10:38:56.365Z\",\"caller\":\"sdk/sync.go:42\",\"msg\":\"Handle ENIConfig Add/Update: us-west-2a, [sg-426fdac8e5c22542], subnet-42658cf14a98b42\"}",
  "_time": 1612262336.365
}