Hi I was wondering why the folowing config results in an error : nxlog.conf; syntax error, unexpected -, expecting (

Module im_msvistalog Exec if $cs-uri-stem== '/health' drop();

I am trying to filter some URL's from the eventlog's IIS-log

I got it partial working with the xpath query but i think that the drop filter method makes it far more flexible.


AskedFebruary 12, 2018 - 5:18pm

Answer (1)

Unfortunately the - character is interpreted as an operator. if you are using xm_csv to parse w3c logs you should specify the field names without the - , e.g. use an underscore instead.:

Fields          date, time, s_ip, cs_method, cs_uri_stem, cs_uri_query,

BTW, the EE already supports curly braces for fields with special characters.

Comments (1)