0
responses

I am parsing my own log file send to logstash. My log file looks like as below.

2018-02-01 12:01:59,574 receive 'AccountReady' is True. account is 12345.
Current local time is 2018-02-01 12:01:59.574. Current UTC time is 2018-02-01 04:01:59.574.
2018-02-01 12:01:59,685 receive 'AccountReady' is True. account is 23456.
Current local time is 2018-02-01 12:01:59.685. Current UTC time is 2018-02-01 04:01:59.685.
2018-02-01 12:01:59,710 receive 'AccountReady' is True. account is 34567.
Current local time is 2018-02-01 12:01:59.710. Current UTC time is 2018-02-01 04:01:59.710.
2018-02-01 12:07:12,460 _Disconnect
2018-02-01 12:07:13,382 BeforeReConnect is triggered.
2018-02-01 12:07:14,449 AfterReConnec is triggered (It`s already reconnected.)
2018-02-01 12:07:14,451 Restart is not trigger because the connection is reconnected.

I have many files like this.

and the nxlog config looks like this

<Extension multi>  
    Module  xm_multiline  
    HeaderLine  /^(\d{4}\-(0[1-9]|1[012])\-([0|1|2]\d|3[0|1]) ([0|1]\d|2[0-3])\:([0-5]\d)\:([0-5]\d),\d{3})/  
</Extension>  


<Input aplogfile>  
    Module       im_file  
    File         "C:\\Code\\MyProj\\bin\\Debug\\Logs\\*.*"  
    SavePos      TRUE   
    ReadFromLast FALSE  
    InputType    multi    
</Input>  


<Output udp_logstash>  
    Module  om_udp  
    Host    192.168.1.104  
    Port    12020  
    OutputType Dgram  
</Output>  

<Route 1>  
    Path        aplogfile => udp_logstash  
</Route>  

Most of these logs are parsed correctly, but some message are not . For example , the first two line should send as one message, but it send twice for first line and second line. This situation are only happened at first line in some files. Does anyone ever touched the same problem? Thanks!

AskedFebruary 7, 2018 - 4:55am

Answers (0)