Not enough fields in CSV input
Hello,
im currently try to send logs from our Exchange Server to a log Collector.
Sadly when i check the NXlogs i see the error not enough fields in CSV Input. Dose anyone know what do in this case?
ERROR if-else failed at line 43, character 3 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; procedure 'parse_csv' failed at line 39, character 35 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; Not enough fields in CSV input, expected 30, got 1 in input
Configuration Code:
<Extension MessageTrackingLog> Module xm_csvFields $date-time,$client-ip,$client-hostname,$server-ip,$server-hostname,$source-context,$connector-id,$source,$event-id,$internal-message-id,$message-id,$network-message-id,$recipient-address,$recipient-status,$total-bytes,$recipient-count,$related-recipient-address,$reference,$message-subject,$sender-address,$return-path,$message-info,$directionality,$tenant-id,$original-client-ip,$original-server-ip,$custom-data,$transport-traffic-type,$log-id,$schema-version Delimiter QuoteMethod None
Thanks a lot :)
Hello,
It seems like that the logs being fed to the input don't really fit into the pattern that xm_csv module expects. I'm not sure what's the delimiter you actually need and I'm also not sure if the input messages are csv formatted (so you need to use csv->to_csv(); instead of csv->parse_csv();)
Can you share the original log being fed into the input module? And the entire config file would also help.
