Hi, You cannot detect an EOF. Nxlog cannot know whether there will be one more line or not, unless it receives an EndLine or another HeaderLine. Simply because there are no new log lines read doesn't mean that the complete log has arrived, the source may stall in the middle of the message. You should either use EndLine, FixedLineCount, RFC5425 style encapsulation (InputType Syslog_TLS), or some other encapsulation e.g. json as suggested in the documentation.
Regards, Botond On Fri, 27 Sep 2013 09:59:52 +0200 Aurélien BOUVARD <prog-a...@hotmail.fr> wrote: > Hi all, > I would like to know if someone have some "tips " to match EOF. > In fact , in my log messages , i know logs always start with a header , that > i already match. > > 2013-09-07 07:45:24.109[client(21924)]CRS-1001:The OCR was formatted using > version 3[client(21924)]CRS-1001:The OCR was formatted using version > 72013-13-27 08:31:26.110[client(21924)]CRS-1001:The OCR was formatted using > version 3[client(21924)]CRS-1001:The OCR was formatted using version 8 > I successfuly match the first message , but i can't match the second , just > because the end is a EOF. > In the documentation , there is this note : > ------------Until there is a new header read, the previous message is stored > in the buffers because the module does not know wherethe message ends. If > there is no new message, the last may sit in the buffers indefinitly. It may > be possible to flush thebuffers using a timer or on EOF, unfortunately these > solutions are not perfect either (though these may be implementedin a later > version). If this behaviour is unacceptable, consider using some kind of an > encapsulation method (JSON, XML,RFC5425, etc) or use and end marker with > EndLine if possible.-------------- > I tried to use this strategy : > Use both EndLine and HeaderLine , and specified \Z (to match EOF , such as in > Perl) but it does not work I also tried a regex such as ^\n\r\s+ to match a > new line and many space (i know it's a bit .."ugly" but i thank it could be a > good way to success > so for the moment , i just use this configuration > <Extension secondmultiline>Module xm_multilineHeaderLine > /^\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d\.(\d+)/##EndLine ???????????</Extension> > Anybody know how to catch EOF in this case ? (with EndLine or just an "or " > condition ) > > Regards, ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk _______________________________________________ nxlog-ce-users mailing list nxlog-ce-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
