Hi,
The problem is that im_file reads the input as single lines, this is then
passed to parse_xml() which only gets a line at a time and this is not
valid xml.
One solution would be to use xm_multiline, but this case cannot be
handled with it properly yet.
The good news is that using a module variable it is possible to
concatenate the lines to form a single Exception xml chunk.
The following should do it:
<Input in>
Module im_file
File "input.xml"
ReadFromLast FALSE
SavePos FALSE
Exec if ($raw_event =~ /<Exceptions>/) or ($raw_event =~
/<\/Exceptions>/) drop(); \
else if ($raw_event =~ /<\/Exception>/) \
{ \
$raw_event = get_var('exception') + $raw_event; \
set_var('exception', ''); \
parse_xml(); \
$EventTime = parsedate($DateField); \
delete($DateField); \
} \
else \
{ \
set_var('exception', get_var('exception') + $raw_event); \
drop(); \
}
</Input>
Regards,
Botond
On Thu, 20 Jun 2013 14:55:08 -0400
Guillaume Ross <[email protected]> wrote:
> Hi,
>
> I'm trying to parse a local log file in XML format and send it as GELF.
>
> What I've tried for now is:
>
> 1 - Load the Extension
>
> <Extension xml>
> Module xm_xml
> </Extension>
>
> 2 - Create an input with im_file
>
> <Input loggerfailure>
> Module im_file
> File "pathtothelog.xml"
> Exec parse_xml();
> </Input>
>
> 3 - Set the output (that part's fine).
>
> What happens is I get multiple GELF messages sent out, as obviously it
> doesn't seem to be able to understand what is the message and what the fields
> are.
>
> The format I am looking at looks like:
>
> <Exceptions>
> <Exception>
> <DateField>2013-06-20 1:30:57 PM</DateField>
> <Field1>text string</Field1>
> <Field2>text string</Field2>
> <Field3>text string</Field3>
> <Field4>text string</Field4>
> <Field5>text string</Field5>
> <Field6>text string</Field6>
> <Field7>text string</Field7>
> </Exception>
> </Exceptions>
>
> I've seen in the documentation (and used) for CSV parsing and W3C logs where
> the fields are specified after the module in the extension, but for xml
> Fields doesn't seem to be valid. I just want to be able to say each message
> is "Exception", each field is a field, parse the date field, and that
> "Exceptions" is just the root.
>
> Thanks for any pointers.
------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:
Build for Windows Store.
http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
nxlog-ce-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
