0

I try to work out why NXLog can't read the complete .csf file witch has the same name but gets edited every 12 hours by windows for a export.

conf file of NXLog:

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _syslog>
    Module  xm_syslog
</Extension>

<Extension gelf>
    Module  xm_gelf
</Extension>

<Extension csv>
    Module xm_csv
    Fields $name, $number, $naam, $group
    FieldTypes string, string, string, string
    Delimiter ;
    #EscapeControl TRUE
</Extension>

<Input in>
    # Use 'im_mseventlog' for Windows XP, 2000 and 2003
    Module im_msvistalog
    Exec if (;) drop();
    # Uncomment the following to collect specific event logs only
    # Query <QueryList>\
# <Query Id="0">\
# <Select Path="Application">*</Select>\
# <Select Path="System">*</Select>\
# <Select Path="Security">*</Select>\
# </Query>\
# </QueryList>
</Input>

<Input in2>
    Module im_file
    File 'D:\Program Files\Service\sync-log\sync.csv'
    #File "/var/log/app/csv.log"
    Exec csv->parse_csv();
</Input>

<Output out>
    Module om_udp
    Host 127.0.0.1
    Port 12201
    OutputType GELF
</Output>

<Route r>
    Path in,in2 => out
</Route>

It reads this file with the following contend:

000002;000002;"Aarts, Hans";FNC_care
000228;000228;"Smit, Jan";FNC_assist
000819;000819;"West, Tessa";FNC_doc
000287;000287;"Trom, Dik";"EML-k"

The result out of NXLog is that he only finds the last row of information. The goal i am trying to go to is that he can read the entire .csv file and separates the given information so that it won't look like this:

000287;000287;"Trom, Dik";"EML-k"

but more like this:

000287
000287
"Trom, Dik"
"EML-k"

The results of the output is used in Graylog.

1 Answer 1

0

The fields (name, number, naam, group) should be available in graylog when sent via GELF. Note that the original data won't be rewritten unless you explicitly tell it to do so with something like this:

Exec $raw_event = $name + "\n" + $number + "\n" + $naam + "\n" + $group;
1
  • This did split the output but Graylog doesn't see the things inside the file after that change.
    – Alex
    Jul 15, 2015 at 10:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .