I'm trying to collect Sql Server error log using the second conf found here: https://nxlog.co/documentation/nxlog-user-guide/mssql.html

<Input mssql_errorlog> Module im_file File 'C:\Program Files\Microsoft SQL Server' +
'MSSQL14.MSSQLSERVER\MSSQL\Log\ERRORLOG' <Exec> # Convert character encoding $raw_event = convert($raw_event, 'UTF-16LE', 'UTF-8'); # Discard empty lines if $raw_event == '' drop(); # Attempt to match regular expression else if $raw_event =~ /(?x)^(?<EventTime>\d+-\d+-\d+\ \d+:\d+:\d+.\d+) \ (?<Source>\S+)\s+(?<Message>.+)$/s { # Convert $EventTime field to datetime type $EventTime = parsedate($EventTime); # Save $EventTime and $Source; may be needed for next event set_var('last_EventTime', $EventTime); set_var('last_Source', $Source); } # If regular expression does not match, this is a multi-line event else { # Use the entire line for the $Message field $Message = $raw_event; # Check if fields were save from the previous event if defined(get_var('last_EventTime')) { # Use $EventTime and $Source from previous event $EventTime = get_var('last_EventTime'); $Source = get_var('last_Source'); } else # Use received timestamp for $EventTime; $Source is unknown $EventTime = $EventReceivedTime; } </Exec> </Input>

I receive the follow error:

ERROR if-else failed at line 71, character 9 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; if-else failed at line 71, character 9 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; assignment failed at line 57, character 47 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; function 'parsedate' failed at line 57, character 46 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. expression evaluation has been aborted; 'unknown' type argument is invalid

It seems parsedate cannot evaluate $EventTime...

Please, help me.

Graziano.