Change log file delimiter?

Question

User-866928011 posted
Is it possible to changed the log file delimiter from a space to some other character? 

Answer 1

User989702501 posted
how does the file content looks like? textline or textword format doesn't support this, only tsv/csv support separator parameters. you want to filter or extract or ?

Answer 2

User2135157030 posted

Did you ver find a way to use a log file delimiter?  I would like to use a pipe if possible.

 

Answer 3

User926551446 posted

Anyone ever find a solution to this? I would like to change the delimiter as well. Some fields contain spaces and it's breaking my parsers.

Thanks.

Answer 4

User2135157030 posted

We have never found a resolution to this.  It would be nice in the advanced logging module if you could set an advanced delimiter (double quote qualified pipes) so you don’t end up with delimiters in your logs.  I would think if a product team was put together to develop an advanced logging module and they had somebody who actually works with logs that this should be a major requirement.  You really can’t even use the IIS advanced logging module because of this.  Maybe somebody should create a ticket with Microsoft.

Thanks,

Chris

 

Answer 5

User926551446 posted

Thanks to a coworker for pointing it out, my backup copy of IISAdvancedLogging_schema.xml was being read and overriding my changes to the file (I guess all files in the schema directory are read, no matter the name). It was possible to for me to set a delimiter in the logs by doing the following:

Edit C:\Windows\System32\inetsrv\config\schema\IISAdvancedLogging_schema.xml

Modify this line:

--                <attribute name="delimiter"                     type="string"   defaultValue=" " />

++              <attribute name="delimiter"                     type="string"   defaultValue="&#9;" />

Change the "defaultValue" to anything you'd like. You can't use control characters such as \t as the value (it will literally use \t as a delimiter). You'll need to use HTML coded character sets, go figure.  

Using the xm_csv module in nxlog, I'm able to specify "Delimiter   \t" to use tab as a delimiter. nxlog can then convert the entire line to JSON and I'm able to send those events to logstash. 

See http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html#processing_parsers_w3c

-Pedro

Answer 6

User926551446 posted

Edited post. I have things working well now using the method above.

Answer 7

User-83962003 posted

LogParser has a commandline argument for this when using -i:IISW3C

-dQuotes         ON|OFF            : Double-quoted strings [default value=OFF]

An example would look something like:

LogParser.exe -i:IISW3C -dQuotes:ON "SELECT * INTO Datagrid FROM Logfile.log"

Answer 8

User350396102 posted

Another way which doesn't require Advanced Logging is to enable Event logging for the IIS site, then all W3C fields are seperated in the event in XML which you can easily parse in PowerShell.