Unexpected Exec block error | Log collection solutions

#1 molnar_istvan_ofsz 2 years ago

I am use nxlog ce edition for a few log file handling and parsing on windows. This files needs a little parsing and rewriting, what i tryed like this:

<Input from_HS_info> Module im_file ReadFromLast true SavePos true RenameCheck true InputType ml_main File "L:\HS[A-Z]*.log"

&lt;Exec&gt;
    $ReadFilename = file_name();

    if ( $ReadFilename =~ /^([A-Za-z]+)_[A-Za-z_0-9]*RNTOFSZ_(OFSZIMHTR\d+).*\.log$/ ) {
        $AccountName = $1;
        $Hostname = $2;
    }

    # Remove extra spaces
    $raw_event = replace($raw_event,'\s\s+1',' ');

    $Channel = 'Software';
    $AcountType = 'Porcess';
    $Severity = 'INFO';
    $Message = $raw_event
    $Tags = '[&quot;' + $AccountName + '&quot;, &quot;prod&quot;, &quot;Instant Money&quot; ]';

    $raw_event = 'InstantMoney ' + $raw_event;
&lt;/Exec&gt;

This snippet starts on line 72 and ends on line 98. When I try to start it sneds an error message to the log file (nxlog.log):

2022-01-24 16:31:54 ERROR Couldn't parse Exec block at C:\Program Files (x86)\nxlog\conf\nxlog.conf:80; couldn't parse statement at line 92, character 13 in C:\Program Files (x86)\nxlog\conf\nxlog.conf; syntax error, unexpected TOKEN_FIELDNAME, expecting ;

Can anyone help me to correct this?

Permalink

#2 jeffron Nxlog ✓ 2 years ago

#1 molnar_istvan_ofsz

I am use nxlog ce edition for a few log file handling and parsing on windows. This files needs a little parsing and rewriting, what i tryed like this: <Input from_HS_info> Module im_file ReadFromLast true SavePos true RenameCheck true InputType ml_main File "L:\HS[A-Z]*.log" <Exec> $ReadFilename = file_name(); if ( $ReadFilename =~ /^([A-Za-z]+)_[A-Za-z_0-9]*RNTOFSZ_(OFSZIMHTR\d+).*\.log$/ ) { $AccountName = $1; $Hostname = $2; } # Remove extra spaces $raw_event = replace($raw_event,'\s\s+1',' '); $Channel = 'Software'; $AcountType = 'Porcess'; $Severity = 'INFO'; $Message = $raw_event $Tags = '["' + $AccountName + '", "prod", "Instant Money" ]'; $raw_event = 'InstantMoney ' + $raw_event; </Exec> This snippet starts on line 72 and ends on line 98. When I try to start it sneds an error message to the log file (nxlog.log): 2022-01-24 16:31:54 ERROR Couldn't parse Exec block at C:\Program Files (x86)\nxlog\conf\nxlog.conf:80; couldn't parse statement at line 92, character 13 in C:\Program Files (x86)\nxlog\conf\nxlog.conf; syntax error, unexpected TOKEN_FIELDNAME, expecting ; Can anyone help me to correct this?

Hi Istvan,

It seems you forgot to add the char ";" at the end of the $Message = $raw_event thus..

$Message = $raw_event;

I hope this helps.

Jeffron