1
answer

Hello, this is my conf (without general directives)

<Extension ml1>
    Module xm_multiline
    FixedLineCount 2
    Exec $raw_event = $raw_event + replace($raw_event, "\r\n", " ");
</Extension>

<Input in1>
    Module im_file
    File "C:\\temp\\in.txt"
    InputType ml1
    SavePos FALSE
    ReadFromLast FALSE
</Input>

<Output out1>
    Module om_file
    File "C:\\temp\\out.txt"
</Output>

<Route 1>
    Path in1 => out1
</Route>

I need merge two lines from in.txt to single line separated with space into out.txt. But this does not work.

AskedJuly 2, 2019 - 4:46pm

Answer (1)

I think all you need for Windows line ending in the xm_multiline Exec is :

Exec $raw_event = replace($raw_event, "\r\n", " ");

Change \r\n to \n for Linux line breaks.

The additional $raw_event + is not needed and will just duplicate the event without the change followed by the change.

AnsweredJuly 2, 2019 - 9:37pm

Comments (4)

  • Toroque's picture

    I use Windows new line character in source log, but I change conf to

    <Extension ml1>
        Module xm_multiline
        FixedLineCount 2
        Exec $raw_event = replace($raw_event, "\n", " ");
    </Extension>
    

    And without change. Output log contains each line from source log (not merged).

    July 3, 2019 - 1:06pm
  • Zhengshi's picture
    (NXLog)

    My apologies, what I meant was to continue using \r\n if you are running Windows new line, but change if you are using Linux.
    Since you are using Windows, you will want:

    Exec $raw_event = replace($raw_event, "\r\n", " ");
    
    

    July 3, 2019 - 4:00pm
  • Toroque's picture

    I have change Exec directive to your suggestion, but still without change.

    July 4, 2019 - 6:54am
  • Zhengshi's picture
    (NXLog)

    I did not have time to look too much into this, but I noticed when I was using Notepad, we seemed to pickup multiple line termination.
    Try the following :

    <Extension ml1>
        Module xm_multiline
        FixedLineCount 2
        Exec if $raw_event =~ /^\s*$/ drop();
        Exec $raw_event =~ s/\R/ /g;
    </Extension>
    <Extension json>
        Module xm_json
    </Extension>
    
    <Input in1>
        Module im_file
        File "C:\\temp\\in.txt"
        InputType ml1
        SavePos FALSE
        ReadFromLast FALSE
    </Input>
    
    <Output out1>
        Module om_file
        File "C:\\temp\\out.txt"
        <Exec>
            $raw_event = "-------------------------------------------------------" +
                         "-----------------------------\n" + $raw_event;
        </Exec>
    </Output>
    
    <Route 1>
        Path in1 => out1
    </Route>
    

    The Exec in the Output was just to separate the events so they were easier to see, feel free to remove. Exec if $raw_event =~ /^\s*$/ drop(); got rid of the extra line termination.

    July 6, 2019 - 2:36am