Assistance required in log file ingestion
I would bet that there are some errors in your nxlog.log
file about the number of fields or that it isn't valid input.
Reasoning: There will appear as more than 4 fields due to your $Details
field on some lines having commas in their value. CN=UserA,CN=Users,DC=org,DC=com
for instance.
Suggestions:
Check the logs to see errors and adjust accordingly. (should always be first step, I think)
This will probably mean either changing the delimiter from your source to something other than comma or using another method like regex to parse the fields.
example using regex. Since your log is pretty straight forward, something like the following may work, though It has not been tested.
<Input in_pwm>
Module im_file
File "C:\\Users\\Documents\\TempOut\\PWM\\PWM.log"
PollInterval 1
ReadFromLast False
#Recursive True
SavePos False
<Exec>
if $raw_event =~ /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z),\s([\w\s]+),\s([\w.\s]+),\s(.+)/
{
$DateTime = $1;
$Type = $2;
$Category = $3;
$Details = $4;
}
</Exec>
</Input>
I like to throw on something like this to my tests to see them more clearly to_json();log_info($raw_event);
.
It will put the fields into a nice JSON package and display it out.
While troubleshooting, I also like running NXLog in the foreground instead of as a service so that I can see messages realtime and make tweaks. nxlog -f