Ask questions. Get answers. Find technical product solutions from passionate experts in the NXLog community.

Help for epoch time conversion

Hi, can anyone help me with the output of my nxlog.conf
I want to convert epoch time from my Bro logs;

Part of the logs:

1482865199.693051 FSYupp4bmRs8tT5Jyg 3 5A00020E4289E78C695848......
1482865200.300809 FmXyl22Uxsq1cudDd8 3 5A00020E4289E78C695848......
1482865200.203542 FAuSUU3X9pgdSJ2D2g 3 5A00020E4289E78C695848.......
1482865201.043722 F0KUdW3Nm5edyqPXLl 3 0CEAC9CAD430F24F334575.......

My current settings are

<Output o.name.log>
 Module om_tcp
 Host xx.xxx.xxx.xxx
 Port xxxx
 OutputType LineBased
</Output>

Thanks!


absolis created
Replies: 1
View post »
last updated
Possible to read log file with new logs added to top of file?

I'm using NXLog to read log files and send to to Logstash. Normally this works fine, but I'm now trying to send logs from a file, where the new events gets added at the top of the file, not the bottom. Now it's not sending anything.

This is from my NXLog config.

<Input file>
Module  im_file
File "C:\\TEMP\\export.txt"
InputType LineBased
Exec $Message = $raw_event;
SavePos TRUE    
ReadFromLast TRUE
Exec if $raw_event =~ /^#/ drop();                    

Is it possible to read from bottom to top?


RVZ created
Replies: 1
View post »
last updated