3
responses

I'm very new to NXLog and have no clue how to fix this. I was setting up an nxlog.conf file to one of our servers and we keep getting this error. It starts with the 'not enough' fields error but then after a few lines it says 'Too many fields'.
There are 21 fields on the W3c fields, but I'm not sure why it seems like it's adding Fields as an input? I added an additional string in the Fieldtypes and also combined date-time instead of 'date, time' but didn't work. Is there a way to fix this in the Conf file? Or should I be looking in the IIS?

Log
expected 20, got 6 in input '#Software: Microsoft Internet Information Services 8.5'
expected 20, got 2 in input '#Version: 1.0'
expected 20, got 3 in input '#Date: 2020-06-30 08:35:19'
Too many fields in CSV input, expected 20, got 21 in input '#Fields: date time c-ip c-port cs-username s-sitename s-computername cs-host s-ip s-port cs-method cs-uri-stem sc-status sc-win32-status sc-substatus sc-bytes cs-bytes time-taken x-session x-fullpath x-debug'

Conf
<Extension w3c_ftp>
Module xm_csv
Fields date, time, c-ip, cs-username, s-sitename, s-computername, s-ip, cs-method, cs-uri-stem, sc-status, sc-win32-status, sc-bytes, cs-bytes, time-taken, s-port, cs-host, sc-substatus, x-session, x-fullpath, x-debug, c-port
FieldTypes string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string
Delimiter ' '
</Extension>

TIA!

AskedJune 30, 2020 - 2:37pm

Answer (1)

Hello and welcome. Please try to change following line:

Fields date, time, c-ip, cs-username, s-sitename, s-computername, s-ip, cs-method, cs-uri-stem, sc-status, sc-win32-status, sc-bytes, cs-bytes, time-taken, s-port, cs-host, sc-substatus, x-session, x-fullpath, x-debug, c-port

with this one

Fields $date, $time, $c-ip, $cs-username, $s-sitename, $s-computername, $s-ip, $cs-method, $cs-uri-stem, $sc-status, $sc-win32-status, $sc-bytes, $cs-bytes, $time-taken, $s-port, $cs-host, $sc-substatus, $x-session, $x-fullpath, $x-debug, $c-port

Regards, Arch

Comments (2)

  • GW2Dave's picture

    Arch,
    I'm still getting the same error. Would changing the FieldTypes of some of the fields from string to integer help?

    <Extension w3c_ftp>
    Module xm_csv
    Fields $date, $time, $c-ip, $cs-username, $s-sitename, $s-computername, $s-ip, $cs-method, $cs-uri-stem, $sc-status, $sc-win32-status, $sc-bytes, $cs-bytes, $time-taken, $s-port, $cs-host, $sc-substatus, $x-session, $x-fullpath, $x-debug, $c-port
    FieldTypes string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string
    Delimiter ' '
    </Extension>

    ERROR if-else failed at line 92, character 207 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; procedure 'parse_csv' failed at line 92, character 84 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; Not enough fields in CSV input, expected 21, got 6 in input '#Software: Microsoft Internet Information Services 8.5'
    ERROR if-else failed at line 92, character 207 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; procedure 'parse_csv' failed at line 92, character 84 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; Not enough fields in CSV input, expected 21, got 2 in input '#Version: 1.0'
    ERROR if-else failed at line 92, character 207 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; procedure 'parse_csv' failed at line 92, character 84 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; Not enough fields in CSV input, expected 21, got 3 in input '#Date: 2020-07-03 08:35:19'
    ERROR if-else failed at line 92, character 207 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; procedure 'parse_csv' failed at line 92, character 84 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; Too many fields in CSV input, expected 21, got 22 in input '#Fields: date time c-ip c-port cs-username s-sitename s-computername cs-host s-ip s-port cs-method cs-uri-stem sc-status sc-win32-status sc-substatus sc-bytes cs-bytes time-taken x-session x-fullpath x-debug'

  • Arkadiy's picture
    (NXLog)

    Accordingly to logs there isn't enough fields in input from csv. Are you sure that every entry in csv could be parsed by given config?