Exclude requests for web sockets from IIS logs
I have
<Extension w3c>
Module xm_csv
Fields $date, $time, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $cs-Referer, $cs-host, $sc-status, $sc-substatus, $sc-win32-status, $time-taken
FieldTypes string, string, string, string, string, string, integer, string, string, string, string, string, integer, integer, integer, integer
Delimiter ' '
QuoteChar '"'
EscapeControl FALSE
UndefValue -
</Extension>
And i have
<Input iis>
Module im_file
File "C:\\inetpub\\logs\\LogFiles\\u_ex*.log"
SavePos TRUE
Exec \
if $raw_event =~ /^#/ drop(); \
else \
{ \
w3c->parse_csv(); \
$EventTime = parsedate($date + " " + $time); \
$EventTime = strftime($EventTime, "%Y-%m-%dT%H:%M:%SZ"); \
$SourceName = "IIS"; \
}
</Input>
When im trying to add something like if $raw_event =~ /^#/ or $sc-status == 101 drop(); \
I am getting error in log like that:
couldn't parse statement at line 91, character 46 in C:\Program Files (x86)\nxlog\conf\nxlog.conf; syntax error, unexpected -, expecting (
I have tried to use similar options, but it doesnt works.
What im doing wrong, help me please. Thanks.