6
responses
responses
Hi everyone! I`m trying to delay an event processing for a second, i.e.: if an event has a description I'll delay the output for a period. I found the sleep method in the Documentation, but it's not working as intended. Below is how my input is configured:
<Input input_file>
Module im_file
File "%LOGPATH%"
ReadFromLast TRUE
Recursive FALSE
<Exec>
if ($raw_event =~ /UPDATE/)
{
parse_json();
}
else if ($raw_event =~ /DELETE/)
{
sleep(2000) # wait 2 seconds before processing this event
parse_json();
}
</Exec>
</Input>
Is is possible to delay/wait for a few seconds before processing an event?
Thank you in advance!
Comments (5)
I tried that but it doesn't work, no matter how many microseconds I specify, it always process the events as soon as they arrive.
Oh, sorry, I missed it, my bad.
Could you share your full config?
Don't worry. The complete configuration file
nxlog.conf
is as follows:Sample log content in
test.log
:What I'm receiving in my
output.json
file:What I expect:
Thank you for your time!
Hello,
There are two main remarks to your case:
delay()
takes microseconds, not milliseconds as the argument, hence, if you want to have seconds - you need to add more "zeros" (000
)delay()
works sequentially, therefore, it will simply pause the whole operations set, without impacting the order.Regards,
Rafal
Thank you for the response. Is there a way for the
sleep()
operation to affect only some events? For example, process them in a different route in the samenxlog.conf
file? The order doesn't matter, I just showed how I expected the outcome to be. What I need is for some events to be processed later, without impacting the others.