1

Hello, this is my conf (without general directives)

<Extension ml1>
Module xm_multiline
FixedLineCount 2
Exec $raw_event =$raw_event + replace($raw_event, "\r\n", " "); </Extension> <Input in1> Module im_file File "C:\\temp\\in.txt" InputType ml1 SavePos FALSE ReadFromLast FALSE </Input> <Output out1> Module om_file File "C:\\temp\\out.txt" </Output> <Route 1> Path in1 => out1 </Route>  I need merge two lines from in.txt to single line separated with space into out.txt. But this does not work. AskedJuly 2, 2019 - 4:46pm ### Answer (1) I think all you need for Windows line ending in the xm_multiline Exec is : Exec$raw_event = replace($raw_event, "\r\n", " ");  Change \r\n to \n for Linux line breaks. The additional $raw_event + is not needed and will just duplicate the event without the change followed by the change.

• I use Windows new line character in source log, but I change conf to

<Extension ml1>
Module xm_multiline
FixedLineCount 2
Exec $raw_event = replace($raw_event, "\n", " ");
</Extension>


And without change. Output log contains each line from source log (not merged).

July 3, 2019 - 1:06pm
• (NXLog)

My apologies, what I meant was to continue using \r\n if you are running Windows new line, but change if you are using Linux.
Since you are using Windows, you will want:

Exec $raw_event = replace($raw_event, "\r\n", " ");



July 3, 2019 - 4:00pm
• I have change Exec directive to your suggestion, but still without change.

July 4, 2019 - 6:54am
• (NXLog)

I did not have time to look too much into this, but I noticed when I was using Notepad, we seemed to pickup multiple line termination.
Try the following :

<Extension ml1>
Module xm_multiline
FixedLineCount 2
Exec if $raw_event =~ /^\s*$/ drop();
Exec $raw_event =~ s/\R/ /g; </Extension> <Extension json> Module xm_json </Extension> <Input in1> Module im_file File "C:\\temp\\in.txt" InputType ml1 SavePos FALSE ReadFromLast FALSE </Input> <Output out1> Module om_file File "C:\\temp\\out.txt" <Exec>$raw_event = "-------------------------------------------------------" +
"-----------------------------\n" + $raw_event; </Exec> </Output> <Route 1> Path in1 => out1 </Route>  The Exec in the Output was just to separate the events so they were easier to see, feel free to remove. Exec if$raw_event =~ /^\s*\$/ drop(); got rid of the extra line termination.

July 6, 2019 - 2:36am