Re: [nxlog-ce-users] Windows file path regex

Tue, 20 Oct 2015 01:25:52 -0700 

Hi,

I will try the EscapeChar \n to see if this works.

In the meantime, please see the current config and an example of an input
file.

Config:

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

# Create the parse rule for IIS logs. You can copy these from the header of
the IIS log file.
<Extension w3c>
    Module xm_csv
    Fields $cs-bytes $sc-bytes $c-ip $s-contentpath $cs(Cookie) $date-local
$date $cs(Host) $cs-method $c-protocol $cs-version $s-proxy $cs(Referer)
$s-computername $s-port $s-ip $s-sitename $sc-status $sc-substatus
$TimeTakenMS $time-local $time $cs-uri-query $cs-uri-stem $cs(User-Agent)
$cs-username $sc-win32-status
    FieldTypes string, string, string, string, string, string, string,
string, string, string, string, string, string, string, string, string,
string, string, string, string, string, string, string, string, string,
string, string
    Delimiter '|'
    QuoteChar '"'
EscapeControl FALSE
    UndefValue -
</Extension>

<Extension json>
    Module xm_json
</Extension>

<Input IIS_AdvancedLogs>
Module im_file
File "C:\\Amit\\TestInput*"
ReadFromLast FALSE
SavePos TRUE
Exec if $raw_event =~ /^#/ drop();\
else\
{\
w3c->parse_csv();\
}
</Input>

<Output out1>
Module om_file
File "C:\\Amit\\Output\\Test.txt"
Exec $raw_event = to_json();
</Output>

<Route 2>
Path IIS_AdvancedLogs => out1
</Route>


Example input:

#Software: IIS Advanced Logging Module
#Version: 1.0
#Start-Date: 2015-10-13 00:00:00.389
#Fields:  cs-bytes sc-bytes c-ip s-contentpath cs(Cookie) date-local date
cs(Host) cs-method c-protocol cs-version s-proxy cs(Referer) s-computername
s-port s-ip s-sitename sc-status sc-substatus TimeTakenMS time-local time
cs-uri-query cs-uri-stem cs(User-Agent) cs-username sc-win32-status
144|148|80.76.218.60|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|HEAD|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|302|0|15|09:04:13.641|08:04:13.641|-|/uk|"Site24x7"|-|0
145|531|80.76.218.60|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|HEAD|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|200|0|655|09:04:14.296|08:04:14.296|-|/uk/|"Site24x7"|-|0
144|148|79.125.119.192|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|HEAD|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|302|0|15|09:04:36.495|08:04:36.495|-|/uk|"Site24x7"|-|0
145|531|79.125.119.192|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|HEAD|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|200|0|468|09:04:36.979|08:04:36.979|-|/uk/|"Site24x7"|-|0
144|148|213.229.90.97|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|HEAD|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|302|0|0|09:07:47.174|08:07:47.174|-|/uk|"Site24x7"|-|0
145|531|213.229.90.97|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|HEAD|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|200|0|670|09:07:47.861|08:07:47.861|-|/uk/|"Site24x7"|-|0
144|148|80.76.218.60|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|HEAD|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|302|0|15|09:10:53.438|08:10:53.438|-|/uk|"Site24x7"|-|0
145|531|80.76.218.60|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|HEAD|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|200|0|670|09:10:54.109|08:10:54.109|-|/uk/|"Site24x7"|-|0
232|424|66.249.93.193|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|302|0|0|09:13:26.584|08:13:26.584|-|/uk/|"Google
favicon"|-|0
262|424|66.249.93.193|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\ErrorHandling\GenericError.htm"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|302|0|0|09:13:26.662|08:13:26.662|-|/uk/ErrorHandling/GenericError.htm|"Google
favicon"|-|0
262|424|66.249.93.197|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\ErrorHandling\GenericError.htm"|-|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|302|0|31|09:13:26.693|08:13:26.693|-|/uk/ErrorHandling/GenericError.htm|"Google
favicon"|-|0
1810|431|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\secure\cms\"|"tools=%7B%22pinned%22%3Afalse%2C%22visible%22%3Afalse%2C%22size%22%3A400%7D;
__epiXSRF=cHs3EgU1CRb89xho0+PGVAuAvLc2X0CHygClt3Ng4NE=; _vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|302|0|15|09:13:30.640|08:13:30.640|-|/uk/secure/cms/|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1771|4021|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\Util\login.aspx"|"__epiXSRF=cHs3EgU1CRb89xho0+PGVAuAvLc2X0CHygClt3Ng4NE=;
_vis_opt_s=2%7C; _vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1;
_vis_opt_exp_129_combi=2; _vis_opt_exp_129_goal_3=1;
_vis_opt_exp_128_exclude=1; _vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|-|"Server1"|443|192.168.15.19|"Site1"|200|0|140|09:13:30.811|08:13:30.811|ReturnUrl=%2fuk%2fsecure%2fcms%2f|/uk/Util/login.aspx|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1688|2053|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\util\styles\login.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|15|09:13:30.827|08:13:30.827|-|/uk/util/styles/login.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1719|748|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\App_Themes\Default\Styles\Extensions\DateBrowser.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|0|09:13:30.827|08:13:30.827|-|/uk/App_Themes/Default/Styles/Extensions/DateBrowser.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1719|1249|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\App_Themes\Default\Styles\Extensions\ImageEditor.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|15|09:13:30.858|08:13:30.858|-|/uk/App_Themes/Default/Styles/Extensions/ImageEditor.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1718|1210|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\App_Themes\Default\Styles\Extensions\linkeditor.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|0|09:13:30.858|08:13:30.858|-|/uk/App_Themes/Default/Styles/Extensions/linkeditor.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1725|1372|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\App_Themes\Default\Styles\Extensions\PageCompareStyles.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|15|09:13:30.889|08:13:30.889|-|/uk/App_Themes/Default/Styles/Extensions/PageCompareStyles.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1720|1078|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\App_Themes\Default\Styles\Extensions\pagetreeview.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|15|09:13:30.889|08:13:30.889|-|/uk/App_Themes/Default/Styles/Extensions/pagetreeview.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1717|1164|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\App_Themes\Default\Styles\Extensions\xformedit.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|15|09:13:30.905|08:13:30.905|-|/uk/App_Themes/Default/Styles/Extensions/xformedit.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1699|658|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\App_Themes\Default\Styles\IE.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|0|09:13:30.905|08:13:30.905|-|/uk/App_Themes/Default/Styles/IE.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1700|1318|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\App_Themes\Default\Styles\IE6.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|0|09:13:30.905|08:13:30.905|-|/uk/App_Themes/Default/Styles/IE6.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1730|544|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\App_Themes\Default\Styles\Extensions\PropertyLinkCollection.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|62|09:13:30.952|08:13:30.952|-|/uk/App_Themes/Default/Styles/Extensions/PropertyLinkCollection.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1707|3381|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\App_Themes\Default\Styles\ToolButton.css"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|31|09:13:30.952|08:13:30.952|-|/uk/App_Themes/Default/Styles/ToolButton.css|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0
1783|1303|192.168.181.65|"C:\Octopus\Applications\xxxxxxxxxxx\MYSITE\2.6.5052.6\WebResource.axd"|"_vis_opt_s=2%7C;
_vwo_uuid=1D8225AD122A148BDCAC87E9137A65B1; _vis_opt_exp_129_combi=2;
_vis_opt_exp_129_goal_3=1; _vis_opt_exp_128_exclude=1;
_vis_opt_exp_129_split=2;
ABTastySession=LiwioHashMRASN%3Anull%5E%7C%5ELiwioUTMC%3A1;
ABTasty=ABTastyUTMB%3A1%5E%7C%5ELiwioUTMA%3A0.10.1439992172157.1440665457326.1442909853167.24%5E%7C%5ELiwioTracking%3A15081914493278407%5E%7C%5EsegmentationTracking%3A15081914493278407;
_hjIncludedInSample=1; _hjUserId=22e423e7-cf50-39b5-b2f3-6f58d0262333;
_vis_opt_exp_132_combi=2;
CurrentSessionId=111205212208149021236019090169137047053103231050225147200037177167126202;
ASP.NET_SessionId=vlny0jysknfsty431sbefnt2;
__utma=91935902.117115967.1439994410.1444402474.1444639676.21;
__utmc=91935902;
__utmz=91935902.1441812052.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
_ga=GA1.3.117115967.1439994410;
gs_u_GSN-100458-B=58806f69fb084a08ab7528bebd8f39d4:54627:192226:1444640360516;
cookiesAccepted_UK=true; _vis_opt_test_cookie=1; __utmt=1;
_gat_UA-246393-19=1;
__utma=142584238.117115967.1439994410.1444658707.1444723115.119;
__utmb=142584238.3.10.1444723115; __utmc=142584238;
__utmz=142584238.1444148353.102.5.utmcsr=cs.xxxx.com|utmccn=(referral)|utmcmd=referral|utmcct=/Home/OrderHistory/12580867;
_ga=GA1.2.117115967.1439994410"|2015-10-13|2015-10-13|"xxxxxxxxxxx"|GET|"https"|"HTTP/1.1"|-|"
https://xxxxxxxxxxx/uk/Util/login.aspx?ReturnUrl=%2fuk%2fsecure%2fcms%2f";|"Server1"|443|192.168.15.19|"Site1"|200|0|0|09:13:30.952|08:13:30.952|d=MUTqidmblHCDwzPD5syyobKvBi0hOODXS9_e4xzdckUpN-l_7LnF2hEn6cuVw_si7X8bi846JhajQGV2QJOJzr9MdiA1&t=635586452020000000|/uk/WebResource.axd|"Mozilla/5.0
(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/45.0.2454.101 Safari/537.36"|-|0

On 19 October 2015 at 11:27, Botond Botyanszki <b...@nxlog.org> wrote:

> Hi,
>
> I think another solution would be to specify a character that does not
> appear in the data, for example:
>  EscapeChar \n
>
> If you send us your .conf and an input sample that will help understand
> the issue.
>
> Regards,
> Botond
>
>
> On Fri, 16 Oct 2015 11:18:05 +0100
> Amit Dattani <m...@amitdattani.com> wrote:
>
> > Hi,
> >
> > Firstly, thanks for the response.
> >
> > Tried what you have suggested and this is not working as this is now
> > escaping my delimiter which is the pipe ( | ) character. So if I use
> > EscapeChar '"' then the output of the log is incorrect.
> >
> > Can you think of anything else or would only regex help?
> >
> > Thanks,
> >
> > Amit
> >
> > On 16 October 2015 at 08:33, Botond Botyanszki <b...@nxlog.org> wrote:
> >
> > > Hi,
> > >
> > > I think you need to add the following to your xm_csv instance:
> > >
> > >  EscapeChar '"'
> > >  EscapeControl FALSE
> > >
> > > The default value for EscapeChar is the backslash and most likely
> that's
> > > causing the windows pathnames to be mangled.
> > >
> > > Regards,
> > > Botond
> > >
> > > On Thu, 15 Oct 2015 20:34:27 +0100
> > > Amit Dattani <m...@amitdattani.com> wrote:
> > >
> > > > Hi,
> > > >
> > > > I am log shipping IIS Advanced Logs and one of the fields which we
> are
> > > > shipping is s-contentpath. This has a windows path in the output.
> > > >
> > > > When parsing this via csv and then converting to json, I see that
> the \
> > > > (backslash) is being removed from the path. I understand that this
> is by
> > > > design and wanted assistance in getting a regex (if that is what is
> > > > needed), to place a double backslash (\\) for each single backslash
> (\).
> > > >
> > > > Eg input
> > > > 144|148|213.229.90.97|"
> > > > *C:\Octopus\Applications\uat.bbbb.xxxx\yyyyxxxxx\2.6.5052.6*
> > > > "|-|2015-10-13|2015-10-13|”test.example.com
> > > >
> > >
> "|HEAD|"https"|"HTTP/1.1"|-|-|"MYSEREVR"|443|192.168.1.19|”MYSITE-SITE"|302|0|15|01:01:28.198|00:01:28.198|-|/uk|"Site24x7"|-|0
> > > >
> > > > Eg output (without regex)
> > > > {"EventReceivedTime":"2015-10-13
> > > >
> > >
> 17:23:19","SourceModuleName":"IIS_AdvancedLogs","SourceModuleType":"im_file","cs-bytes":"144","sc-bytes":"244","c-ip":”2.2.2.2","s-contentpath":”
> > > > *C:OctopusApplicationsuat.bbbb.xxxxyyyyxxxx2.6.5052.6*
> > > >
> > >
> ","cs(Cookie)":null,"date-local":"2015-10-1","date":"2015-10-1","cs(Host)”:”
> > > > test.example.com
> > > >
> > >
> ","cs-method":"HEAD","c-protocol":"https","cs-version":"HTTP/1.1","s-proxy":null,"cs(Referer)":null,"s-computername”:"MYSERVER","s-port":"443","s-ip":"192.168.1.19","s-sitename”:"MYSITE-SITE","sc-status":"302","sc-substatus":"0","TimeTakenMS":"0","time-local":"01:17:14.850","time":"00:17:14.850","cs-uri-query":null,"cs-uri-stem":"/uk","cs(User-Agent)":"Site24x7","cs-username":null,"sc-win32-status":"0"}
> > > >
> > > > Thanks in advance,
> > > >
> > > > Amit
> > >
> > >
> > >
> ------------------------------------------------------------------------------
> > > _______________________________________________
> > > nxlog-ce-users mailing list
> > > nxlog-ce-users@lists.sourceforge.net
> > > https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
> > >
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> nxlog-ce-users mailing list
> nxlog-ce-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
>

------------------------------------------------------------------------------

_______________________________________________
nxlog-ce-users mailing list
nxlog-ce-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users

Reply via email to