Exclude requests for web sockets from IIS logs

View thread

V_Vorobey

I have 

 

<Extension w3c>
    Module            xm_csv
    Fields            $date, $time, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $cs-Referer, $cs-host, $sc-status, $sc-substatus, $sc-win32-status, $time-taken
    FieldTypes        string, string, string, string, string, string, integer, string, string, string, string, string, integer, integer, integer, integer
    Delimiter        ' '
    QuoteChar        '"'
    EscapeControl    FALSE
    UndefValue        -
</Extension>

 

And i have 

 

<Input iis>
    Module            im_file
    File            "C:\\inetpub\\logs\\LogFiles\\u_ex*.log"
    SavePos            TRUE
    Exec \
                    if $raw_event =~ /^#/ drop(); \
                    else \
                        { \
                            w3c->parse_csv(); \
                            $EventTime = parsedate($date + " " + $time); \
                            $EventTime = strftime($EventTime, "%Y-%m-%dT%H:%M:%SZ"); \
                            $SourceName = "IIS"; \
                        }
</Input>

 

When im trying to add something like if $raw_event =~ /^#/ or $sc-status == 101 drop(); \

I am getting error in log like that: 

couldn't parse statement at line 91, character 46 in C:\Program Files (x86)\nxlog\conf\nxlog.conf; syntax error, unexpected -, expecting (

I have tried to use similar options, but it doesnt works. 

What im doing wrong, help me please. Thanks.