I am trying to parse some logs coming in and trying to figure out the proper way to build the nxlog.conf when specifying what to do depending on the conditions met in the parser. I have a working conf file that can read all the logs from a file and parse them into one set of conditions but how do I add multiple IF statements in a single Exec block?

<Input NetMotion>
   Module      im_file
   File        "C:\Testing-logs\NetMotion.txt"
   <Exec>
   if $raw_event =~ /m_user="([^"]+).+?pop_ip_srv="([^"]+).+?ses_start="([^"]+).+?ses_state="([^"]+).+?vip="([^"]+)/
   {
       if $4 = 'Connected' $event_type = 'VPN_SESSION_IP_ASSIGNED';
       {		
       		$version = 'v1';
       		$time = $3;
       		$account = $1;
       		$assigned_ip = $6;
       		$source_ip = $2;
       		$authentication_result = 'SUCCESS';
       		$authentication_target = $5;
       	}
       if $3 == 'Disconnected' $event_type = 'VPN_SESSION_IP_TERMINATION';
       {
       		$version = 'v1';
       		$time = $2;
       		$account = $1;
       }
   }
   </Exec>
</Input>

The above code works in the fact that it doesn't give me any errors in the NXLog log file however the actual log lines are mixed up. If the events match 'VPN_SESSION_IP_ASSIGNED'  then it all works just fine. This gives me the order of event_type, version, time, account, assigned_ip, source_ip, authentication_result, authentication_target which is exactly what I need.

 However for the lines where it doesn't match, it messes up the order and puts version first, and then tacks on the event_type = 'VPN_SESSION_IP_TERMINATION' at the end.

How do I get it so that when the $event_type = 'VPN_SESSION_IP_TERMINATION' the log format only shows the fields I want e.g. event_type, version, time, account.

I tried a different method where I put the second if statement directly after the first and it worked to keep the order but I still don't know how to drop the unnecessary fields from the termination events.

<Input NetMotion>
   Module      im_file
   File        "C:\Testing-logs\NetMotion.txt"
   <Exec>
   if $raw_event =~ /m_user="([^"]+).+?pop_ip_srv="([^"]+).+?ses_start="([^"]+).+?ses_state="([^"]+).+?vip="([^"]+)/
   {
       if $4 = 'Connected' $event_type = 'VPN_SESSION_IP_ASSIGNED';
       if $3 == 'Disconnected' $event_type = 'VPN_SESSION_IP_TERMINATION';
       $version = 'v1';
       $time = $3;
       $account = $1;
       $assigned_ip = $6;
       $source_ip = $2;
       $authentication_result = 'SUCCESS';
       $authentication_target = $5;
   }
   </Exec>
</Input>

Would I do an additional if statement after that to basically say, 

if $event_type == 'VPN_SESSION_IP_TERMINATION'
{
	delete($assigned_ip);
	delete($source_ip);
	delete($authentication_result);
    delete($authentication_target);
}

Any and all help is appreciated!