We are sending our logs to Loggly with the below config, but when they arrive
at Loggly, they are not searchable in JSON format - only as plain text.
<Extension json>
Module xm_json
</Extension>
<Input in>
Module im_msvistalog
Query <QueryList>\
<Query Id="0">\
<Select Path="Application">*</Select>\
<Select Path="System">*</Select>\
<Select Path="Security">*</Select>\
<Suppress Path="Security">*[System[(EventID='4656') or
(EventID='4658') or (EventID='5156') or (EventID='5158')]]</Suppress>\
</Query>\
</QueryList>
Exec $Message = " " + $EventID + ": " + $Message; \
to_json();
</Input>
Any ideas what I'm doing wrong? Thanks.
NOTICE: This transmission (and the documents and any attachments accompanying
it) contain confidential information belonging to the sender. The information
is intended only for the use of the individual or entity named above. If you
are not the intended recipient, you are hereby notified that any use,
disclosure, copying, distribution, delivery or the taking of any action in
reliance on the contents of this transmission (and/or the documents and any
attachments accompanying it) is unauthorized and strictly prohibited. If you
have received this transmission in error, please immediately notify the sender.
All reasonable precautions have been taken to ensure no viruses are present in
this e-mail. Our company does not accept responsibility for any loss or damage
arising from the use of this e-mail or attachments and if you are the intended
recipient of this transmission, we recommend that you subject this e-mail and
any attachments to your virus checking procedures prior to use.
------------------------------------------------------------------------------
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________
nxlog-ce-users mailing list
nxlog-ce-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
