2
responses

Hi,
I use multiple input files.
I wish to log periodically (every minute) in nxlog.log the filename of the current input file to control all process chain, and add a Exec log_info("Current InputFile  : " + $InputFileName1); in a Schedule Block in Output section.
But it seems that it doesn’t work in a Schedule block => error on nxlog.log => “…field not available in this context…”

My config :
<Input in>
 Module  im_file
 SavePos TRUE
 ReadFromLast FALSE
 ActiveFiles 20
 CloseWhenIdle TRUE
 File "/var/log/MUP10/sac/APMUZS4WBS04*.log"
 Exec $InputFileName1 = file_name();
</Input>

<Output logstash>
 Module om_tcp
 Port 6002
 Host 10.x.y.z
 Exec        create_stat("stat", "RATE", 60); add_stat("stat", 1);

    <Schedule>
        Every   60 sec
        Exec    log_info("Events send to logstash for the last minute: " + get_stat("stat"));
        Exec log_info("Current InputFile  : " + $InputFileName1);
    </Schedule>

</Output>

If I move my Exec log_info("Current InputFile  : " + $InputFileName1); line in a Schedule block in my input section => same error
The only way I find is to move the line in Input section without using a schedule block, like this :
<Input in>
 Module  im_file
 SavePos TRUE
 ReadFromLast FALSE
 ActiveFiles 20
 CloseWhenIdle TRUE
 File "/var/log/MUP10/sac/APMUZS4WBS04*.log"
 Exec $InputFileName1 = file_name();
Exec log_info("Current InputFile  : " + $InputFileName1);
</Input>

But it writes too many files in log….

Any idea ?

Thanks in advance

AskedJune 15, 2016 - 12:07pm

Answers (2)

Ok, I found a solution...

I went through create_var()...it may be help otherswho have the same need...

Below, my workaround :

<Input in03>
 Module im_file
 Exec create_var("varInputfile1");
 SavePos TRUE
 ReadFromLast FALSE
 ActiveFiles 20
 CloseWhenIdle TRUE
 #PollInterval 60 # 60sec
 File "/var/log/MUP10/sac/APMUZS4WBS03*.log"
 Exec $InputFileName1 = file_name(); set_var("varInputfile1", $InputFileName1);
 <Schedule>
  Every   60 sec
  Exec log_info("Current Input Files for Appliance 03 : " + get_var("varInputfile1"));
 </Schedule>
</Input>

 

Fields are not accessible within <Schedule> because it is triggered by a timer and not by an event record. You can either directly invoke file_name() or use module variables with set_var() and get_var().