Hi, When there are 22 fields in the input vs 23 fields defined in the config this will work because the last one is treated as "undef". This is the same as if a value is missing in the middle, i.e.: ,,,,,,,,,,,,,,,,,,,, This was added to cover the corner case when the last field has or doesn't have a trailing comma. AFAIK the CSV format requires fixed number of values, so you cannot have x number of fields (and commas) on one line and y on the next. I think IIS will not write such a mixed format. If you want to process logs from several IIS instances with different configs then you should be using multiple xm_csv module instances, one for each format.
Regards, Botond On Thu, 20 Jun 2013 03:46:41 +0000 Marvin Nipper <[email protected]> wrote: > I'm trying to understand the underlying logic of the Fields parameters within > xm_csv, as I have a situation where the number of parameters may not be > definitely known. > > After getting some errors (discussed below), I ended up codifying an xm_csv > definition like this one: > Fields $p1, $p2, $p3, $p4, $p5, $p6, $p7, $p8, $p9, $p10, > $p11, \ > $p12, $p13, $p14, $p15, $p16, $p17, $p18, > $p19, $p20, $p21, $p22, $p23 > > However, when I first started I had coded the fields like this, with some > padded (extra) fields, because it seemed to fail if there weren't enough > fields available: > Fields $p1, $p2, $p3, $p4, $p5, $p6, $p7, $p8, $p9, $p10, > $p11, \ > $p12, $p13, $p14, $p15, $p16, $p17, $p18, > $p19, $p20, $p21, $p22, $p23, \ > $a1, $a2, $a3, $a4, $a5, $a6, $a7, $a8, $a9, > $a10 > > However, the definition above (with 33 available fields) failed, with an > error that (edited) says: > "Not enough fields in CSV input, expected 33, got 22 in input". > > So here's what I'm not understanding, why does parse_csv allow 23 Fields to > be specified, with only 22 input values, but then fails when there are 24 (or > 33) Fields defined? I'm trying to deal with IIS input where there may be a > default configuration (with 14 params), or the full set of 22 params. But if > I define 22 (or 23), and only get 14, then it appears that the whole thing > will fail. And, because it's part of an if-else expression, it basically > "jumps out" of that entire expression, and then none of the parsed > information gets properly built in the $raw_event field (because those > activities are nested in my "else" leg). > > I can see why it might generate an error if it doesn't have enough fields, > but I don't understand why an "excess of one Field" is OK, but any further > excess Fields causes a complete failure? I just figure that I must be > missing something. Possibly some "ignore mismatch" directive, that would > prevent the failure situation? Any guidance would be appreciated. > > (And, I guess I would have even expected "too few" parameters to not result > in a complete failure. I would have simply expected that it would have "stop > parsing data", because if you got an occasional "garbage line", with two much > data, which might be the case with some applications, this failure scenario > would also cause a complex if-else structure to fail completely, most likely > resulting in the loss of a lot of formatting activity.) > > Sorry for my confusion! Thanks for your help. > > Marvin Nipper > > > The information transmitted, including any content in this communication is > confidential, is intended only for the use of the intended recipient and is > the property of The Western Union Company or its affiliates and subsidiaries. > If you are not the intended recipient, you are hereby notified that any use > of the information contained in or transmitted with the communication or > dissemination, distribution, or copying of this communication is strictly > prohibited. If you have received this communication in error, please notify > the Western Union sender immediately by replying to this message and delete > the original message > ------------------------------------------------------------------------------ This SF.net email is sponsored by Windows: Build for Windows Store. http://p.sf.net/sfu/windows-dev2dev _______________________________________________ nxlog-ce-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
