0

I want to read MSSQL logs from log file, Written the NXLOG code as following,

<Input sql-logs>
    Module      im_file
    File 'C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\ERRORLOG*'
    ReadFromLast TRUE
    Exec        if $raw_event =~ /^#/ drop();                    \
                else                                             \
                {                                                \
                    sql->parse_csv();                            \
                    #$EventTime = parsedate($date + " " + $time); \
                    to_json ();                                  \
                }
</Input>

Where module SQL is,

<Extension sql>      
    Module      xm_csv
    Fields      $date, $time, $hostname, $message
    FieldTypes  string, string, string, string
    Delimiter   ' '
</Extension>

And Output configuration is,

<Output sql-out>
    Module      om_tcp
    Host        192.168.1.14
    Port        5222
</Output>

I have uploaded sample file in box, You can open the file using chrome, There is no error message in both NXLOG and Logstash, But I couldn't see the output.

I mean there is no data received from this file.

halfer
  • 19,824
  • 17
  • 99
  • 186
Gunaseelan
  • 14,415
  • 11
  • 80
  • 128
  • Your link requires registration at box. Without seeing your config file, I'll ask: have you seen the multi-line filter? – Alain Collins Dec 18 '14 at 15:05
  • If there is no new data appended to the file when using "ReadFromLast TRUE" you won't see any output. – b0ti Dec 18 '14 at 19:07
  • First change the output section(write to tmp file in same machine where you are reading the file). If you able to get the log in the tmp file then some prob in transferring of logs or else some prob in reading the file. – Chittaranjan Sethi Jan 01 '15 at 04:09

0 Answers0