Hi there,

this might be a strange question but I'm new nxlog and was wondering what the difference between an input module and a processor module is.
the background to my question is:
I want to collect logs centrally on an nxlog server, and have configured all my clients to send their logs in a nxlog-binary format. at the moment I'm testing this with Windows IIS webserver logs.

on the nxlog server i want to read the binary logs and process them. Based on the processor I'd like to forward them to two separate destinations, outputting the logs in GELF and CSV format.

Now my question:

While this codeblock in the Input module works fine:

<Input in_syslog_tcp>

  Module  im_tcp

  Host  0.0.0.0

  Port  80

 

  <Exec>

        $Hostname = hostname();

        w3c->parse_csv();

        $EventTime = parsedate($date + " " + $time);

        $raw_event = $Hostname + ' IIS-NXLOG  '  + $raw_event;

        $SourceName = "IIS";

         w3c->to_csv();

  </Exec>

  InputType Binary

</Input>

<Processor transform_iis>
  Module      pm_null
   <Exec>

        $Hostname = hostname();
        w3c->parse_csv();
        $EventTime = parsedate($date + " " + $time);
        $raw_event = $Hostname + ' IIS-NXLOG  '  + $raw_event;
        $SourceName = "IIS";
        w3c->to_csv();
  </Exec>
</Processor>