1
response

I am use nxlog ce edition for a few log file handling and parsing on windows.
This files needs a little parsing and rewriting, what i tryed like this:

<Input from_HS_info>
Module im_file
ReadFromLast true
SavePos true
RenameCheck true
InputType ml_main
File "L:\HS\[A-Z]*.log"

<Exec>
$ReadFilename = file_name();

if ( $ReadFilename =~ /^([A-Za-z]+)_[A-Za-z_0-9]*RNTOFSZ_(OFSZIMHTR\d+).*\.log$/ ) {
$AccountName = $1;
$Hostname = $2;
}

# Remove extra spaces
$raw_event = replace($raw_event,'\s\s+1',' ');

$Channel = 'Software';
$AcountType = 'Porcess';
$Severity = 'INFO';
$Message = $raw_event
$Tags = '["' + $AccountName + '", "prod", "Instant Money" ]';

$raw_event = 'InstantMoney ' + $raw_event;
</Exec>

This snippet starts on line 72 and ends on line 98.
When I try to start it sneds an error message to the log file (nxlog.log):

2022-01-24 16:31:54 ERROR Couldn't parse Exec block at C:\Program Files (x86)\nxlog\conf\nxlog.conf:80; couldn't parse statement at line 92, character 13 in C:\Program Files (x86)\nxlog\conf\nxlog.conf; syntax error, unexpected TOKEN_FIELDNAME, expecting ;

Can anyone help me to correct this?

AskedJanuary 24, 2022 - 4:52pm

Answer (1)

Hi Istvan,

It seems you forgot to add the char ";" at the end of the $Message = $raw_event thus..

$Message = $raw_event;

I hope this helps.

Jeffron