cdienger wrote:"Or" doesn't appear to be a valid option. Try:
Code: Select all
<Input windowsfile>
Module im_file
File 'C:\Windows\system32\dhcp\dhcpsvrlog*'
SavePos TRUE
# ReadFromLast FALSE
Exec $Message = $raw_event;
</Input>
test again, and PM me a complete copy of the configuration as well as nxlog.log if there are still problems.
----------------------------------------------------------------------------------------------------------------------------------------
Hi
By OR I meant trying both paths (no luck)
Attached conf file.
---------------------
#
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Mon, 04 Mar 2019 14:48:31 +0000
#
#
# Global inputs
#
input {
tcp {
port => 514
type => switchlog
}
udp {
port => 514
type => switchlog
}
tcp {
type => 'eventlog'
port => 3515
codec => json {
charset => 'CP1252'
}
}
tcp {
type => 'import_raw'
tags => 'import_raw'
port => 2056
}
tcp {
type => 'import_json'
tags => 'import_json'
port => 2057
codec => json
}
tcp {
port => 4444
type => SIEBELappLOG
}
udp {
port => 4444
type => SIEBELappLOG
}
tcp {
port => 4445
type => TCappLOG
}
udp {
port => 4445
type => TCappLOG
}
tcp {
type => 'ADFSeventlog'
port => 3516
codec => json {
charset => 'CP1252'
}
}
tcp {
port => 5544
type => syslog
}
udp {
port => 5544
type => syslog
}
tcp {
port => 4446
type => SKYBOTappLOG
}
udp {
port => 4446
type => SKYBOTappLOG
}
tcp {
port => 4447
type => EFECTEappLOG
}
udp {
port => 4447
type => EFECTEappLOG
}
tcp {
port => 5545
type => syslog
}
udp {
port => 5545
type => syslog
}
tcp {
port => 4448
type => RPAROBPappLOG
}
udp {
port => 4448
type => RPAROBPappLOG
}
tcp {
port => 4450
type => SELENIUMLOG
}
udp {
port => 4450
type => SELENIUMLOG
}
tcp {
port => 5546
type => DHCPlog
}
udp {
port => 5546
type => DHCPlog
}
}
#
# Local inputs
#
#
# Global filters
#
filter {
if [program] == 'apache_access' {
grok {
match => [ 'message', '%{COMBINEDAPACHELOG}']
}
date {
match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z' ]
}
mutate {
replace => [ 'type', 'apache_access' ]
convert => [ 'bytes', 'integer' ]
convert => [ 'response', 'integer' ]
}
}
if [program] == 'apache_error' {
grok {
match => [ 'message', '\[(?<timestamp>%{DAY:day} %{MONTH:month} %{MONTHDAY} %{TIME} %{YEAR})\] \[%{WORD:class}\] \[%{WORD:originator} %{IP:clientip}\] %{GREEDYDATA:errmsg}']
}
mutate {
replace => [ 'type', 'apache_error' ]
}
}
if [type] == "syslog" {
grok {
match => { "message" => "<%{POSINT:pri}>%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:logsource} %{DATA:program}(?:\[%{POSINT:pid}\])?: %{GREEDYDATA:syslog_message}" }
}
}
}
#
# Local filters
#
#
# Global outputs
#
#
# Local outputs
#