NXLog to Read File, Logging from Bottom to Top

Question

I'm using NXLog to read log files and send to to Logstash. Normally this works fine, but I'm now trying to send logs from a file, where the new events gets added at the top of the file, not the bottom. Now it's not sending anything.

This is from my NXLog config.

<Input file>
Module  im_file
File "C:\\TEMP\\export.txt"
InputType LineBased
Exec $Message = $raw_event;
SavePos TRUE    
ReadFromLast TRUE
Exec if $raw_event =~ /^#/ drop();

Is it possible to read from bottom to top?

score 1 · Answer 1 · answered Sep 11 '15 at 00:08

1

You might want to try setting it like:

SavePos FALSE
ReadFromLast FALSE

I used it case the log file was rotated.

answered Sep 11 '15 at 00:08

Json Rich

13
4

I would suggest to explain why? What does it? – peterh Sep 11 '15 at 00:35
@peterh since you used TRUE for both SavePos and ReadFromLast it will just read what's newly appended line at the bottom of the file. Therefore, if you make these FALSE NXLog will read again all the content of the file whenever it's updated. – Json Rich Sep 11 '15 at 03:33

score 0 · Answer 2 · answered Jul 30 '15 at 14:44

I don't think that's possible, this would need a special module. Appending new lines to the beginning of the file also means that the log source will either truncate and rewrite the whole file with the new line prepended, or it creates a new file and deletes the old. This in itself would be quite confusing to im_file.

NXLog to Read File, Logging from Bottom to Top

2 Answers2