nxlog process logs files based on filename

Question

I have lots of log files in C:\Logs.

I have IIS logs in each individual site folder (W3SVCXX, where XX is site id from IIS) but inside this same C:\Logs\ folder I have other log files from those same websites but logged via Log4Net as part of the application running at the website.

My current NXLog Config:

<Input i_IISSITES>
    Module    im_file
    File    "C:\Logs\u_ex*"
    SavePos  TRUE
    Recursive TRUE
    InputType   LineBased
    Exec $Hostname = 'stg-01-iom';
    Exec if $raw_event =~ /^#/ drop();   \
       else                               \
       {                                  \
            w3c->parse_csv();             \
            $SourceName = "IIS";          \
            $EventTime = parsedate($date + " " + $time); \
            $Message = to_json();         \
       }
</Input>
<Output o_PLAINTEXT>
    Module      om_udp
    Host        10.50.108.32
    Port        5555    
</Output>
<Route r_IIS>
    Path i_IISSITES => o_PLAINTEXT
</Route>

This works perfectly currently for IIS logs which match the filename U_ex*.

Folder structure:

c:\Logs\

    - L009
            - Dir1
            - Dir2
                    - FileName.Log
    - L008
             - Dir3
                    - RandomFileName.Log
    - L008
    - W3SVC1
            - u_ex1232.log
    - W3SVC2
    - W3SVC3

etc etc..

Now I'm able to be specific for IIS logs because the filename is u_ex* but with my other log files they could be called anything.

So for my other input I need to be able to target all .log but not u_ex.log.

Any ideas?

Thanks,

Michael

Answer 1

If you need to process all logs then instead of defining two input instances you could just use one and parse differently depending on the file name:

<Exec>
  if file_name() =~ /u_ex\d+\.log$/
  {
    # parse as IIS
  }
  else
  {
    # parse as other
  }
</Exec>