I try to work out why NXLog can't read the complete .csf file witch has the same name but gets edited every 12 hours by windows for a export.
conf file of NXLog:
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension _syslog>
Module xm_syslog
</Extension>
<Extension gelf>
Module xm_gelf
</Extension>
<Extension csv>
Module xm_csv
Fields $name, $number, $naam, $group
FieldTypes string, string, string, string
Delimiter ;
#EscapeControl TRUE
</Extension>
<Input in>
# Use 'im_mseventlog' for Windows XP, 2000 and 2003
Module im_msvistalog
Exec if (;) drop();
# Uncomment the following to collect specific event logs only
# Query <QueryList>\
# <Query Id="0">\
# <Select Path="Application">*</Select>\
# <Select Path="System">*</Select>\
# <Select Path="Security">*</Select>\
# </Query>\
# </QueryList>
</Input>
<Input in2>
Module im_file
File 'D:\Program Files\Service\sync-log\sync.csv'
#File "/var/log/app/csv.log"
Exec csv->parse_csv();
</Input>
<Output out>
Module om_udp
Host 127.0.0.1
Port 12201
OutputType GELF
</Output>
<Route r>
Path in,in2 => out
</Route>
It reads this file with the following contend:
000002;000002;"Aarts, Hans";FNC_care
000228;000228;"Smit, Jan";FNC_assist
000819;000819;"West, Tessa";FNC_doc
000287;000287;"Trom, Dik";"EML-k"
The result out of NXLog is that he only finds the last row of information. The goal i am trying to go to is that he can read the entire .csv file and separates the given information so that it won't look like this:
000287;000287;"Trom, Dik";"EML-k"
but more like this:
000287
000287
"Trom, Dik"
"EML-k"
The results of the output is used in Graylog.