Hi,

I am trying to insert a custom, static text into the raw event (so that the output has the custom text + the log). However, it refuses to work. The log output is the same whether I add or remove my exec $raw_event

My config input and output look like this:

 <Input in>
     Module      im_msvistalog
   <QueryXML>
      <QueryList>
         <Query Id='0'>
            <Select Path='System'>*</Select>
            <Select Path='Application'>*</Select>
            <Select Path='Security'>*</Select>
         </Query>
      </QueryList>
   </QueryXML>
	 Exec $raw_event = "STATIC CONTENT" + $raw_event;

 </Input>
 


 <Output out>
     Module      om_udp
     Host        XX.XX.XX.XX
     Port        514
     Exec        to_syslog_snare();
 </Output>


 <Route 1>
     Path        in => out
 </Route>

Logs:

2025-02-12 11:09:20 INFO nxlog-ce-3.2.2329 started