4
responses
responses
Hello,
I have a CSV column that has returns in it. If I try to run NxLog, it errors out saying it expected 16 columns and got 0 (for the blank lines), got 1 (when there was one entry), etc.
The configuration I have works if I open up the CSV in excel or something and replace the returns with a ; instead.
I was wondering if there was a way to do that with NxLog. Maybe something like
Exec $Message = replace($column11, "\r\n", ";");
but i cannot seem to get NxLog to run correctly because it's spitting out the errors stated above.
Any help would be great.
Thanks
Comments (4)
It looks like this in a text file.
But when you open it in Excel, all the paragraph data within the ** is under the Message Column. In text, it's in quotes. I just switched to ** to pick out a little easier.
I hope this helps
You are going to run into a lot of issues and gotchas trying to get this to work, I think. If this is truly meant to be CSV, I would go back to the source and have them use a different delimiter than space (or tab, since it is copied it is hard to tell). comma, pipe, semi-colon all would probably be good delimiters.
It looks like this is from a Windows system. What is the source? there may be other, easier ways to get the same information.
This should show how changing the source to have a unique delimiter would help simplify things. I used pipe (
|
) in this example.I decided to take a couple minutes to show an example. I took some liberties with your input and assumed the spacing was tabs (
\t
) so you will need to modify that if not.You should notice how
xm_multiline
andxm_csv
can work together with distinguishable delimiters.Output
Input:
You will need to parse it when you have the full record by using
xm_multiline
. If you are luckyxm_csv
will be able to parse it if the delimiter is set correctly.