Below is my NXLOG configuration file to parse

define ROOT C:\Program Files (x86)\nxlog

<Extension gelf>
  Module xm_gelf

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension multiline>
    Module          xm_multiline
    HeaderLine      /^<event>/
    EndLine         /^</event>/

<Extension xmlparser>
    Module          xm_xml

<Extension json>
    Module          xm_json

<Input filein>
    Module          im_file
    File            "C:\\test\\server\\Azurion\\SoftwarePackage\\test.xml"
    InputType       multiline
        # Discard everything that doesn't seem to be an xml event
        if $raw_event !~ /^<event>/ drop();

        # Parse the xml event

        #Rewrite some fields
        $EventTime = parsedate($timestamp);

        # Convert to JSON

<Output fileout>
    Module          om_file
    File            "C:\\Users\\320005935\\Desktop\\new.txt"

<Route parse_xml>
    Path            filein => fileout

This is my XML file

<?xml version="1.0" encoding="UTF-8"?>
  <timestamp>2012-11-23 23:00:00</timestamp>
    Something bad happened.
    Please check the system.
  <timestamp>2012-11-23 23:00:12</timestamp>
   System state is now back to normal.
AskedAugust 27, 2019 - 6:20pm

Answer (1)

This all actually looks good. I ran your config just to verify and I received the following:

{"SourceModuleName":"filein","SourceModuleType":"im_file","severity":"ERROR","message":"\n    Something bad happened.\n    Please check the system.\n  ","EventTime":"2012-11-23T23:00:00.000000-05:00"}
{"SourceModuleName":"filein","SourceModuleType":"im_file","severity":"INFO","message":"\n   System state is now back to normal.\n  ","EventTime":"2012-11-23T23:00:12.000000-05:00"}

Are you updating this file or is it a static file? If it is a static file, NXLog will not read portions that exist before the service is started by default. I added the following to the config to read the file from the start:

    SavePos         False
    ReadFromLast    False

You may want to do something about the newline characters though.