Good Morning,

Hoping someone can help me find out where I have gone wrong here. I'm trying to get these xml files through nxlog using multiline. I'm targeting each section between <row></row> tags each as an event but nxlog seems to still be grabbing individual lines instead (checked via log_info and what comes up in logz.io).

config: define ROOT C:\Program Files (x86)\nxlog define ROOT_STRING C:\Program Files (x86)\nxlog define CERTDIR %ROOT%\cert Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Extension charconv> Module xm_charconv AutodetectCharsets utf-8, euc-jp, utf-16, utf-32, iso8859-2 </Extension> <Extension xml> Module xm_xml </Extension> <Extension json> Module xm_json </Extension> <Extension multiline> Module xm_multiline HeaderLine /<row>/
</Extension> <Input OBLogs> Module im_file SavePos TRUE #ReadFromLast False File "D:\SERVER1\LogFiles\Hyland\error-profile\error-profile*.xml" InputType multiline Exec log_info("Reading log file: [" + file_name() + "]"); #Exec if $raw_event !~ /^<row>/ drop(); Exec parse_xml(); #Exec log_info("ParsedxmlRaw: [" + $raw_event + "]"); Exec $Hostname = hostname();
Exec to_json(); Exec log_info("Sending: [" + $raw_event + "]"); Exec $raw_event = '[Redact][type=onbase-xml]' + $raw_event; </Input> <Output out> Module om_tcp Host listener-wa.logz.io Port 8010 </Output> <Route OB> Path OBLogs => out </Route>

Sample log file: <?xml version="1.0" encoding="utf-8"?> <diagnosticsLog type="error-profile" startDate="06/26/2021 08:04:55"> <!--Build 60--> <columns> <column friendlyName="time" name="time" /> <column friendlyName="Result" name="Result" /> <column friendlyName="Module" name="Module" /> <column friendlyName="Class" name="Class" /> <column friendlyName="SourceFile" name="SourceFile" /> <column friendlyName="Method" name="Method" /> <column friendlyName="SourceLine" name="SourceLine" /> <column friendlyName="Severity" name="Severity" /> <column friendlyName="MachineName" name="MachineName" /> <column friendlyName="IpAddress" name="IpAddress" /> <column friendlyName="ErrorId" name="ErrorId" /> <column friendlyName="ProcessID" name="ProcessID" /> <column friendlyName="ThreadID" name="ThreadID" /> <column friendlyName="TimeSpan" name="TimeSpan" /> <column friendlyName="User" name="User" /> <column friendlyName="HTTPSessionID" name="HTTPSessionID" /> <column friendlyName="HTTPForward" name="HTTPForward" /> <column friendlyName="SessionID" name="SessionID" /> <column friendlyName="SessionGUID" name="SessionGUID" /> <column friendlyName="Datasource" name="Datasource" /> <column friendlyName="Sequence" name="Sequence" /> <column friendlyName="LocalSequence" name="LocalSequence" /> <column friendlyName="Message" name="Message" /> <column friendlyName="AppPoolName" name="AppPoolName" /> </columns> <rows> <row> <col name="time">06/26/2021 08:04:55</col> <col name="TimeSpan">N/A</col> <col name="ThreadID">0x0000000B</col> <col name="User">UNITYSCHEDSERVICE</col> <col name="HTTPSessionID"></col> <col name="HTTPForward"></col> <col name="SessionGUID">cb5ce31f-641e-4eba-aaab-906691d26dec</col> <col name="SessionID">251185112</col> <col name="Datasource">Prod</col> <col name="AppPoolName"></col> <col name="IpAddress"></col> <col name="MachineName"></col> <col name="Result">0xFFFFFFFF80131500</col> <col name="Message">'Doc - Create PDF/TIFF File for This Document' was not executed because the document with ID: (123) has invalid extension 'rtf'</col> <col name="Module">Hyland.Core.Workflow.Tasks</col> <col name="Class">Hyland.Core.Workflow.Tasks.Foundation.Actions.CreatePdfTiffFile.ExecutionService</col> <col name="Method">ExecuteImpl</col> <col name="SourceFile"></col> <col name="SourceLine">0</col> <col name="Severity">Error</col> <col name="ErrorId">48c99a2c-facf-4a4e-948e-5f933ad2eae2</col> </row> <row> <col name="time">06/26/2021 08:04:55</col> <col name="TimeSpan">N/A</col> <col name="ThreadID">0x0000000B</col> <col name="User">UNITYSCHEDSERVICE</col> <col name="HTTPSessionID"></col> <col name="HTTPForward"></col> <col name="SessionGUID">cb5ce31f-641e-4eba-aaab-906691d26dec</col> <col name="SessionID">251185112</col> <col name="Datasource">Prod</col> <col name="AppPoolName"></col> <col name="IpAddress"></col> <col name="MachineName"></col> <col name="Result">0xFFFFFFFF80131500</col> <col name="Message"></col> <col name="Module">Hyland.Core.Workflow.Tasks</col> <col name="Class">Hyland.Core.Workflow.Tasks.ExecutionServiceBase</col> <col name="Method">Execute</col> <col name="SourceFile"></col> <col name="SourceLine">0</col> <col name="Severity">Error</col> <col name="ErrorId">48c99a2c-facf-4a4e-948e-5f933ad2eae2</col> </row> <row> <col name="time">06/26/2021 08:04:55</col> <col name="TimeSpan">N/A</col> <col name="ThreadID">0x0000000B</col> <col name="User">UNITYSCHEDSERVICE</col> <col name="HTTPSessionID"></col> <col name="HTTPForward"></col> <col name="SessionGUID">cb5ce31f-641e-4eba-aaab-906691d26dec</col> <col name="SessionID">251185112</col> <col name="Datasource">Prod</col> <col name="AppPoolName"></col> <col name="IpAddress"></col> <col name="MachineName"></col> <col name="Result">0xFFFFFFFF80131500</col> <col name="Message"></col> <col name="Module">Hyland.Core.Workflow</col> <col name="Class">Hyland.Core.Workflow.Action</col> <col name="Method">Execute</col> <col name="SourceFile"></col> <col name="SourceLine">0</col> <col name="Severity">Error</col> <col name="ErrorId">48c99a2c-facf-4a4e-948e-5f933ad2eae2</col> </row> </diagnosticsLog>

Thank you so much for any help you can offer!