Dear Community,

I am using NXlog community edition and am experiencing the problem that using the following configuration, the log sent to rsyslog arrives with the characters #011 as tab and #015 as carriage return:

<Extension _syslog>

    Module      xm_syslog

</Extension>

<Extension _charconv>

    Module xm_charconv

    AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32

</Extension>

<Extension _exec>

    Module xm_exec

</Extension>

<Extension json>

    Module xm_json

</Extension>

<Input internal>

    Module im_internal

</Input>

<Input eventlog>

    Module im_msvistalog

Query <QueryList>\

    <Query Id="0">\

    <Select Path="Application">*</Select>\

    <Select Path="System">*</Select>\

    <Select Path="Security">*</Select>\

</Query>\

</QueryList>

    Exec if ($EventID == 5156) OR ($EventID == 5158) drop();

    Exec $HOSTNAME=hostname();

    Exec $Message = replace($Message, "#011", " ");

    Exec $raw_event = replace($raw_event, "#011", " ");

#    Exec $Message =~ s/(\t|\R)/ /g;

#    Exec $Message =~ s/(\t|\R|\011|\015)/ /g;

</Input> 

<Output out>

    Module om_tcp

    Host %OUTPUT_DESTINATION_ADDRESS%

    Port %OUTPUT_DESTINATION_PORT%

    Exec $Message = replace($Message, "#011", " ");

    Exec $raw_event = replace($raw_event, "#011", " ");

    Exec to_syslog_snare();

    Exec $Message = replace($Message, "#011", " ");

    Exec $raw_event = replace($raw_event, "#011", " ");

</Output>

<Route 1>

    Path eventlog, internal => out

</Route>

Can you tell me how to solve the problem? It seems not to remove the tab and carriage return characters.

Thank you very much.