Change log file delimiter? RRS feed

  • Question

  • User-866928011 posted
    Is it possible to changed the log file delimiter from a space to some other character? 
    Tuesday, September 11, 2012 1:29 PM

All replies

  • User989702501 posted
    how does the file content looks like? textline or textword format doesn't support this, only tsv/csv support separator parameters. you want to filter or extract or ?
    Tuesday, September 11, 2012 9:10 PM
  • User2135157030 posted

    Did you ver find a way to use a log file delimiter?  I would like to use a pipe if possible.


    Thursday, January 31, 2013 1:27 PM
  • User926551446 posted

    Anyone ever find a solution to this? I would like to change the delimiter as well. Some fields contain spaces and it's breaking my parsers.


    Friday, July 26, 2013 2:33 PM
  • User2135157030 posted

    We have never found a resolution to this.  It would be nice in the advanced logging module if you could set an advanced delimiter (double quote qualified pipes) so you don’t end up with delimiters in your logs.  I would think if a product team was put together to develop an advanced logging module and they had somebody who actually works with logs that this should be a major requirement.  You really can’t even use the IIS advanced logging module because of this.  Maybe somebody should create a ticket with Microsoft.




    Wednesday, July 31, 2013 2:50 PM
  • User926551446 posted

    Thanks to a coworker for pointing it out, my backup copy of IISAdvancedLogging_schema.xml was being read and overriding my changes to the file (I guess all files in the schema directory are read, no matter the name). It was possible to for me to set a delimiter in the logs by doing the following:

    Edit C:\Windows\System32\inetsrv\config\schema\IISAdvancedLogging_schema.xml

    Modify this line:

    --                <attribute name="delimiter"                     type="string"   defaultValue=" " />

    ++              <attribute name="delimiter"                     type="string"   defaultValue="&#9;" />

    Change the "defaultValue" to anything you'd like. You can't use control characters such as \t as the value (it will literally use \t as a delimiter). You'll need to use HTML coded character sets, go figure.  

    Using the xm_csv module in nxlog, I'm able to specify "Delimiter   \t" to use tab as a delimiter. nxlog can then convert the entire line to JSON and I'm able to send those events to logstash. 

    See http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html#processing_parsers_w3c


    Monday, August 5, 2013 3:13 PM
  • User926551446 posted

    Edited post. I have things working well now using the method above.

    Thursday, August 8, 2013 12:13 PM
  • User-83962003 posted

    LogParser has a commandline argument for this when using -i:IISW3C

    -dQuotes         ON|OFF            : Double-quoted strings [default value=OFF]

    An example would look something like:

    LogParser.exe -i:IISW3C -dQuotes:ON "SELECT * INTO Datagrid FROM Logfile.log"

    Wednesday, August 21, 2013 5:38 PM
  • User350396102 posted

    Another way which doesn't require Advanced Logging is to enable Event logging for the IIS site, then all W3C fields are seperated in the event in XML which you can easily parse in PowerShell.

    Tuesday, September 29, 2015 9:46 PM