SQL Integration | NXLog configuration errors

#1 Mary Joy Baquilar 10 months ago

Hello There,

We're in the process of collecting SQL server logs and followed instructions in this link (Example 2)https://nxlog.co/documentation/nxlog-user-guide/mssql.html

We are having the following error message:

ERROR if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; assignment failed at line 53, character 47 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; function 'parsedate' failed at line 53, character 46 in c:\Program Files\nxlog\conf\nxlog.conf. expression evaluation has been aborted; 'unknown' type argument is invalid
ERROR if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; assignment failed at line 53, character 47 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; function 'parsedate' failed at line 53, character 46 in c:\Program Files\nxlog\conf\nxlog.conf. expression evaluation has been aborted; 'unknown' type argument is invalid
ERROR last message repeated 2 times

We're using the latest version of the community edition.

Here is a snippet from the config file, including the lines numbers as reference to the error above.

Let us know if you need further information. Many thanks.

Permalink

#2 konstantinos Nxlog ✓ 10 months ago

#1 Mary Joy Baquilar

Hello There,We're in the process of collecting SQL server logs and followed instructions in this link (Example 2)https://nxlog.co/documentation/nxlog-user-guide/mssql.htmlWe are having the following error message:ERROR if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; assignment failed at line 53, character 47 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; function 'parsedate' failed at line 53, character 46 in c:\Program Files\nxlog\conf\nxlog.conf. expression evaluation has been aborted; 'unknown' type argument is invalid ERROR if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; assignment failed at line 53, character 47 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; function 'parsedate' failed at line 53, character 46 in c:\Program Files\nxlog\conf\nxlog.conf. expression evaluation has been aborted; 'unknown' type argument is invalid ERROR last message repeated 2 timesWe're using the latest version of the community edition. Here is a snippet from the config file, including the lines numbers as reference to the error above. Let us know if you need further information. Many thanks.

Hi Mary,

I have a feeling the formatting is not right in the example you've referred to.

Instead of splitting this in two lines 53, 54, please try having the whole statement in one:

        else if $raw_event =~ /(?x)^(?<EventTime>\d+-\d+-\d+\ \d+:\d+:\d+.\d+)\ (?<Source>\S+)\s+(?<Message>.+)$/s

Cheers,

Konstantinos