How to refer to fields with dash in name in Exec


I'm working on a setup for collecting IIS logs and send them to Graylog.
Here I stumbled into a problem with refering to fields with a dash in the field name.

I would really like the fields to have prober w3c names in greylog, so I dont wanna remove those dashes.

In the CSV module I have:

AskedMarch 18, 2019 - 1:41pm

NXlog Service failed to start on Windows 2000: Error 1053

The nxlog service will not start up - I get an error 1053 The service did not respond to the start or control request in a timely fashion.
No log file written to the logging directory so cant troubleshoot any further - nothing in the event logs that helps with any answers.
Anyone have any experience with running this on Windows 2000

AskedMarch 15, 2019 - 3:46pm

Dealing with floating point values and JSON

Since there's no support for floating point data types in nxlog, given a log entry that contains numbers with decimal points, is the best option to convert them to fixed point integers? For example, given a field $value = "123.45" (a string) extracted from a log line using regex or xm_kvp, if I go directly to_json, I end up with a string in JSON.

I don't see any way to put the value, without quotes, into JSON. Am I correct?

AskedMarch 11, 2019 - 5:12pm

version.sh has some non-portable constructs

From the source code, the version.sh file needed a few changes to make it work on Mac. First, the method of deriving the patch number from git needs to trim leading white space.

Before, After:

git log --pretty=oneline 2>/dev/null | wc -l

git log --pretty=oneline 2>/dev/null | wc -l | tr -d ' '

Second, echo -n is not portable across linux versions. To achieve output without a new-line, use printf instead.

AskedMarch 9, 2019 - 6:04pm

Key-Value Pairs and numeric fields

From this example, in the docs: Name=Mike, Weight=64, Age=24, Pet=dog, Height=172

The sample shows accessing the fields like this, effectively casting certain values to integers: if ( integer($Weight) > integer($Height) - 100 )

AskedMarch 8, 2019 - 2:37pm