SQL Integration | NXLog configuration errors
Hello There,
We're in the process of collecting SQL server logs and followed instructions in this link (Example 2)https://nxlog.co/documentation/nxlog-user-guide/mssql.html
We are having the following error message:
ERROR if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; assignment failed at line 53, character 47 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; function 'parsedate' failed at line 53, character 46 in c:\Program Files\nxlog\conf\nxlog.conf. expression evaluation has been aborted; 'unknown' type argument is invalid
ERROR if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; if-else failed at line 73, character 9 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; assignment failed at line 53, character 47 in c:\Program Files\nxlog\conf\nxlog.conf. statement execution has been aborted; function 'parsedate' failed at line 53, character 46 in c:\Program Files\nxlog\conf\nxlog.conf. expression evaluation has been aborted; 'unknown' type argument is invalid
ERROR last message repeated 2 times
We're using the latest version of the community edition.Â
Here is a snippet from the config file, including the lines numbers as reference to the error above.
Â
Let us know if you need further information. Many thanks.
Hi Mary,
I have a feeling the formatting is not right in the example you've referred to.
Instead of splitting this in two lines 53, 54, please try having the whole statement in one:
else if $raw_event =~ /(?x)^(?<EventTime>\d+-\d+-\d+\ \d+:\d+:\d+.\d+)\ (?<Source>\S+)\s+(?<Message>.+)$/s
Cheers,
Konstantinos