Hi,
The CSV parser is strict and expects the same number of fields for each
record. As an enhancement, this could be allowed in a future version.
For now you could possibly do the parsing using a regexp:
Exec if $raw_event =~ /^([^|]+)\|([^|]+)\|([^|]+)/ { \
$Hostname = $1; \
$EventTime = parsedate($2); \
$Else = $3; \
}
The above is untested, it's just to give you the idea.
Regards,
Botond
On Mon, 19 Oct 2015 17:02:07 -0300
Igor Gatis <igorga...@gmail.com> wrote:
> TL;DR: How to ignore columns while parsing CSV?
>
>
> I'm trying to watch a file whose each line is Pipe Separated Values. It
> looks like this:
>
> RD000D3AC015BF|2015/10/19 15:01:58|Server binding to 0.0.0.0:10001
> RD000D3AC015BF|2015/10/16 12:44:22|10008|IP084|ERR|shutdown|shutdown|IP /
> 127.0.0.1|PRT 52105
> RD000D3AC015BF|2015/10/16 12:44:22|10008|IP085|ERR|shutdown|shutdown|IP /
> 127.0.0.1|PRT 52107|TRANSPARENT||OK|||
>
> As you can see, number of variables varies. I tried to use parse_csv() from
> xm_csv like:
>
> <Extension lsscsv>
> Module xm_csv
> Fields $Hostname, $EventTime, $Else
> Delimiter '|'
> </Extension>
>
> <Input lsslogs>
> Module im_file
> File "D:\\Logs\\Input.log"
> SavePos TRUE
> Exec lsscsv->parse_csv();
> Exec \
> $parseddate = parsedate($EventTime) ; \
> $Message = $raw_event;
> </Input>
>
> But it fails with:
>
> 2015-10-19 19:52:41 ERROR procedure 'parse_csv' failed at line 63,
> character 25 in D:\Program Files (x86)\nxlog\conf\nxlog.conf. statement
> execution has been aborted; Too many fields in CSV input, expected 2, got 3
> in input 'RD000D3AC015BF|2015/10/16
> 12:44:22|10008|IP085|ERR|shutdown|shutdown|IP /127.0.0.1|PRT
> 52107|TRANSPARENT||OK|||'
>
> Do I need to use script for that?
------------------------------------------------------------------------------
_______________________________________________
nxlog-ce-users mailing list
nxlog-ce-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
