#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define IGNORE_COMMENT if $raw_event =~ /^#/ drop();
define BASEDIR C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking
define AgentLog_dir C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\AgentLog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
#LogLevel DEBUG
<Extension _syslog>  
    Module      xm_syslog
</Extension>

<Extension _json> 
    Module        xm_json
</Extension>

<Extension ExAgentLog>
    Module        xm_csv
    Fields        $Timestamp,$SessionId,$LocalEndpoint,$RemoteEndpoint,$EnteredOrgFromIP,$MessageId,$P1FromAddress,$P2FromAddresses,$Recipient,$NumRecipients,$Agent,$Event,$Action,$SmtpResponse,$Reason,$ReasonData,$Diagnostics
    FieldTypes    String,String,String,String,String,String,String,String,String,Integer,String,String,String,String,String,String,String
    Delimiter    ,
</Extension>

<Extension ExMSGTRK>
    Module        xm_csv
    Fields        $date-time,$client-ip,$client-hostname,$server-ip,$server-hostname,$source-context,$connector-id,$source,$event-id,$internal-message-id,$message-id,$recipient-address,$recipient-status,$total-bytes,$recipient-count,$related-recipient-address,$reference,$message-subject,$sender-address,$return-path,$message-info,$directionality,$tenant-id,$original-client-ip,$original-server-ip,$custom-data
    FieldTypes    String,String,String,String,String,String,String,String,String,String,String,String,String,Integer,Integer,String,String,String,String,String,String,String,String,String,String,String
    Delimiter    ,
</Extension>

<Extension charconv>
    Module xm_charconv
    AutodetectCharsets utf-8,UNICODE,utf-16, utf-32, iso8859-2
</Extension>

<Input in>
    Module      im_file
    File        '%BASEDIR%\MSGTRK????????*-*.LOG'
    ReadFromLast FALSE
    Exec        if $raw_event =~ /^#/ drop();\                
                else \
                {    \
                    ExMSGTRK->parse_csv();\
                    delete($SourceModuleName);\
                    delete($SourceModuleType);\
                    delete($EventReceivedTime);\
                    $SourceName="Message Tracking Log";    \
                    to_json();\
                }
</Input>

<Input in2>
    Module        im_file
    ReadFromLast FALSE
    File        '%AgentLog_dir%\AgentLog*.LOG'
    
    EXEC         if $raw_event =~ /^#/ drop();\
                else \
                {\
                    ExAgentLog->parse_csv();    \
                    delete($SourceModuleName);    \
                    delete($SourceModuleType);    \
                    delete($EventReceivedTime); \
                    $SourceName="Agent Log";    \
                    to_json();            \
                }

</Input>

<Output out2>
    Module      om_tcp
    Host        172.18.1.11
    Port        5142
</Output>

<Route 2>
    Path        in,in2 => out2
</Route>