0
responses

Good Morning,

Hoping someone can help me find out where I have gone wrong here. I'm trying to get these xml files through nxlog using multiline. I'm targeting each section between <row></row> tags each as an event but nxlog seems to still be grabbing individual lines instead (checked via log_info and what comes up in logz.io).

config:
define ROOT C:\\Program Files (x86)\\nxlog
define ROOT_STRING C:\\Program Files (x86)\\nxlog
define CERTDIR %ROOT%\\cert
Moduledir %ROOT%\\modules
CacheDir %ROOT%\\data
Pidfile %ROOT%\\data\\nxlog.pid
SpoolDir %ROOT%\\data
LogFile %ROOT%\\data\\nxlog.log
<Extension charconv>
Module xm_charconv
AutodetectCharsets utf-8, euc-jp, utf-16, utf-32, iso8859-2
</Extension>
<Extension xml>
Module xm_xml
</Extension>
<Extension json>
Module xm_json
</Extension>
<Extension multiline>
Module xm_multiline
HeaderLine /<row>/
</Extension>
<Input OBLogs>
Module im_file
SavePos TRUE
#ReadFromLast False
File "D:\\SERVER1\\LogFiles\\Hyland\\error-profile\\error-profile*.xml"
InputType multiline
Exec log_info("Reading log file: [" + file_name() + "]");
#Exec if $raw_event !~ /^<row>/ drop();
Exec parse_xml();
#Exec log_info("ParsedxmlRaw: [" + $raw_event + "]");
Exec $Hostname = hostname();
Exec to_json();
Exec log_info("Sending: [" + $raw_event + "]");
Exec $raw_event = '[Redact][type=onbase-xml]' + $raw_event;
</Input>
<Output out>
Module om_tcp
Host listener-wa.logz.io
Port 8010
</Output>
<Route OB>
Path OBLogs => out
</Route>

Sample log file:
<?xml version="1.0" encoding="utf-8"?>
<diagnosticsLog type="error-profile" startDate="06/26/2021 08:04:55">
<!--Build 60-->
<columns>
<column friendlyName="time" name="time" />
<column friendlyName="Result" name="Result" />
<column friendlyName="Module" name="Module" />
<column friendlyName="Class" name="Class" />
<column friendlyName="SourceFile" name="SourceFile" />
<column friendlyName="Method" name="Method" />
<column friendlyName="SourceLine" name="SourceLine" />
<column friendlyName="Severity" name="Severity" />
<column friendlyName="MachineName" name="MachineName" />
<column friendlyName="IpAddress" name="IpAddress" />
<column friendlyName="ErrorId" name="ErrorId" />
<column friendlyName="ProcessID" name="ProcessID" />
<column friendlyName="ThreadID" name="ThreadID" />
<column friendlyName="TimeSpan" name="TimeSpan" />
<column friendlyName="User" name="User" />
<column friendlyName="HTTPSessionID" name="HTTPSessionID" />
<column friendlyName="HTTPForward" name="HTTPForward" />
<column friendlyName="SessionID" name="SessionID" />
<column friendlyName="SessionGUID" name="SessionGUID" />
<column friendlyName="Datasource" name="Datasource" />
<column friendlyName="Sequence" name="Sequence" />
<column friendlyName="LocalSequence" name="LocalSequence" />
<column friendlyName="Message" name="Message" />
<column friendlyName="AppPoolName" name="AppPoolName" />
</columns>
<rows>
<row>
<col name="time">06/26/2021 08:04:55</col>
<col name="TimeSpan">N/A</col>
<col name="ThreadID">0x0000000B</col>
<col name="User">UNITYSCHEDSERVICE</col>
<col name="HTTPSessionID"></col>
<col name="HTTPForward"></col>
<col name="SessionGUID">cb5ce31f-641e-4eba-aaab-906691d26dec</col>
<col name="SessionID">251185112</col>
<col name="Datasource">Prod</col>
<col name="AppPoolName"></col>
<col name="IpAddress"></col>
<col name="MachineName"></col>
<col name="Result">0xFFFFFFFF80131500</col>
<col name="Message">'Doc - Create PDF/TIFF File for This Document' was not executed because the document with ID: (123) has invalid extension 'rtf'</col>
<col name="Module">Hyland.Core.Workflow.Tasks</col>
<col name="Class">Hyland.Core.Workflow.Tasks.Foundation.Actions.CreatePdfTiffFile.ExecutionService</col>
<col name="Method">ExecuteImpl</col>
<col name="SourceFile"></col>
<col name="SourceLine">0</col>
<col name="Severity">Error</col>
<col name="ErrorId">48c99a2c-facf-4a4e-948e-5f933ad2eae2</col>
</row>
<row>
<col name="time">06/26/2021 08:04:55</col>
<col name="TimeSpan">N/A</col>
<col name="ThreadID">0x0000000B</col>
<col name="User">UNITYSCHEDSERVICE</col>
<col name="HTTPSessionID"></col>
<col name="HTTPForward"></col>
<col name="SessionGUID">cb5ce31f-641e-4eba-aaab-906691d26dec</col>
<col name="SessionID">251185112</col>
<col name="Datasource">Prod</col>
<col name="AppPoolName"></col>
<col name="IpAddress"></col>
<col name="MachineName"></col>
<col name="Result">0xFFFFFFFF80131500</col>
<col name="Message"></col>
<col name="Module">Hyland.Core.Workflow.Tasks</col>
<col name="Class">Hyland.Core.Workflow.Tasks.ExecutionServiceBase</col>
<col name="Method">Execute</col>
<col name="SourceFile"></col>
<col name="SourceLine">0</col>
<col name="Severity">Error</col>
<col name="ErrorId">48c99a2c-facf-4a4e-948e-5f933ad2eae2</col>
</row>
<row>
<col name="time">06/26/2021 08:04:55</col>
<col name="TimeSpan">N/A</col>
<col name="ThreadID">0x0000000B</col>
<col name="User">UNITYSCHEDSERVICE</col>
<col name="HTTPSessionID"></col>
<col name="HTTPForward"></col>
<col name="SessionGUID">cb5ce31f-641e-4eba-aaab-906691d26dec</col>
<col name="SessionID">251185112</col>
<col name="Datasource">Prod</col>
<col name="AppPoolName"></col>
<col name="IpAddress"></col>
<col name="MachineName"></col>
<col name="Result">0xFFFFFFFF80131500</col>
<col name="Message"></col>
<col name="Module">Hyland.Core.Workflow</col>
<col name="Class">Hyland.Core.Workflow.Action</col>
<col name="Method">Execute</col>
<col name="SourceFile"></col>
<col name="SourceLine">0</col>
<col name="Severity">Error</col>
<col name="ErrorId">48c99a2c-facf-4a4e-948e-5f933ad2eae2</col>
</row>
</diagnosticsLog>

Thank you so much for any help you can offer!

AskedJune 26, 2021 - 5:19pm

Answers (0)