Multiline file source config for ldif

[janwaush]

Hi,

as the title states I'm looking for an improvement of an existing configuration snippet to parse ldif logs.

The current snippet looks like that:

[sources.source_ldif]
type = "file"
include = [ "/tmp/test.ldif" ]
ignore_older_secs = 600
read_from = "beginning"
ignore_checkpoints = true

    [sources.source_ldif.multiline]
    start_pattern = "^#"
    mode = "halt_with"
    condition_pattern = "^#"
    timeout_ms = 1000

This works for most of the "events" but it fails for these which have an additional # in the event like this one:

# modify 1687132883 dc=test,dc=test cn=admin,dc=test,dc=test IP=127.0.0.1:60908 conn=665091
# realdn: cn=ldap-server,ou=system,dc=test,dc=test
dn: uid=sys.test,ou=People,dc=test,dc=test
changetype: modify
replace: pwdLastSuccess
pwdLastSuccess: 20230619000123Z
-
replace: entryCSN
entryCSN: 20230619000123.158473Z#000000#014#000000
-
replace: modifiersName
modifiersName: cn=test,dc=test,dc=test
-
replace: modifyTimestamp
modifyTimestamp: 20230619000123Z
-
# end modify 1687132883

What would I need to change in the config so that only the last # is used or in combination a regex like #\wend or similar?

Thank you very much and BR,

Jan

[janwaush]

Hi again,

^#\\send\\.* for the condition pattern does the job. I tried something similar earlier already but there might have been a syntax error.

BR,

Jan