[SOLVED] Issue with multiline log parsing (empty output)

#1 guruster 6 years ago

Hi all, I have this config

Panic Soft

define ROOT     C:\Program Files (x86)\nxlog
define LOGDIR   %ROOT%\data
define LOGFILE  %LOGDIR%\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\modules
CacheDir  %ROOT%\data
Pidfile   %ROOT%\data\nxlog.pid
SpoolDir  %ROOT%\data

<Extension multilines>
	Module xm_multiline
	FixedLineCount 2
</Extension>

<Input InputData>
	Module im_file
	File "C:\\txt\\event.txt"
	InputType multilines
</Input>

<Output OutputData>
	Module om_file
	File "C:\\txt\\txt1.log"
</Output>

<Route 1>
	Path InputData => OutputData
</Route>

And this input log file

event1
Data1
event2
Data2
event3
Data3
event4
Data4
event5
Data5
event6
Data6

But output file is always empty and nxlog.log is without errors or warnings. I want to merge two lines into single line.

Permalink

#2 Zhengshi Nxlog ✓ 6 years ago

#1 guruster

Hi all, I have this config Panic Soft define ROOT C:\Program Files (x86)\nxlog define LOGDIR %ROOT%\data define LOGFILE %LOGDIR%\nxlog.log LogFile %LOGFILE% Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data <Extension multilines> Module xm_multiline FixedLineCount 2 </Extension> <Input InputData> Module im_file File "C:\\txt\\event.txt" InputType multilines </Input> <Output OutputData> Module om_file File "C:\\txt\\txt1.log" </Output> <Route 1> Path InputData => OutputData </Route> And this input log file event1 Data1 event2 Data2 event3 Data3 event4 Data4 event5 Data5 event6 Data6 But output file is always empty and nxlog.log is without errors or warnings. I want to merge two lines into single line.

Your code looks good. By default NXLog will only pull info that is newer than when the process was started. That is to say, it won't read back through a file unless you tell it to.
Try adding ReadFromLast and SavePos set to False.

<Input InputData>
    Module im_file
    File "C:\\txt\\event.txt"
    InputType multilines
    ReadFromLast False
    SavePos False
</Input>

The alternative would be to add lines after NXLog is running.