Using NXLog with IIS and have json output

Question

I am trying to use nxlog to oarse the IIS files and create a JSON output so that I can later push it into logstash

However all I get is the raw data in the file and not the formatted output I was led to expect e.g. https://github.com/StephenHynes7/confs/blob/master/windows_iis_JSON/nxlog-iis.conf.

This is my config file

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT D:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _syslog>
    Module      xm_syslog
</Extension>

<Extension json>
    Module      xm_json
</Extension>

# Select the input folder where logs will be scanned
# Create the parse rule for IIS logs. You can copy these from the header of the IIS log file.
# Uncomment Extension w3c for IIS logging
<Extension w3c>
    Module xm_csv
    #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken

    Fields $date, $time, $s-sitename, $s-computername, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $cs-cookie, $cs-referrer, $cs-host, $sc-status, $sc-substatus, $sc-win32-status, $sc-bytes, $cs-bytes, $time-taken
    FieldTypes string, string, string, string, string, string, string, string, integer, string, string, string, string, string, string, integer, integer, integer, integer, integer, integer
    Delimiter ' '
    UndefValue  -
    QuoteChar   '"'
    EscapeControl FALSE
</Extension>

<Input iis_logs>  
    Module    im_file
    File    "C:\\Resources\\Directory\\\\u_ex*.log"
    ReadFromLast True
    Recursive True
    SavePos True
    Exec if $raw_event =~ /^#/ drop();              \
       else                         \
       {                            \
            w3c->parse_csv();                   \
            $EventTime = parsedate($date + " " + $time);    \
            $SourceName = "IIS";                \
            $Message = to_json();               \
       }
</Input>  

<Output debug>
    Module      om_file
    File        "C:\\nxlog-debug.txt"
</Output>

<Route 1>
    Path        iis_logs => debug
</Route>

and my output (not json)

2015-09-05 07:42:00 W3SVC1273337584 ****** *.*.*.* GET / - 443 - *.*.*.* HTTP/1.1 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) - - *.*.*.* 403 14 0 5530 258 31
2015-09-05 07:42:00 W3SVC1273337584 ****** *.*.*.* GET / - 443 - *.*.*.* HTTP/1.1 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) - - *.*.*.* 403 14 0 5530 258 16
2015-09-05 07:53:05 W3SVC1273337584 ****** *.*.*.* GET / - 443 - *.*.*.* HTTP/1.1 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) - - *.*.*.* 403 14 0 5530 258 31
2015-09-05 07:53:06 W3SVC1273337584 ****** *.*.*.* GET / - 443 - *.*.*.* HTTP/1.1 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) - - *.*.*.* 403 14 0 5530 258 31

I assume I am close but what am I missing?

Answer 1

om_file writes $raw_event into the output by default and all other fields are discarded including $Message. So you need either

$raw_event = to_json();

or simply just

to_json();

The two are equivalent.