Nxlog Query Conditionals?

Graylog Add-ons
1

Hi all,

How do I divide my NxLog configuration file into conditionals based on queries? I have an nxlog.conf that doesn’t apply equally to all hosts, and NxLog fails if it has to query something that doesn’t exist on a Windows server. In psuedocode:

if [ exists Microsoft-Windows-TerminalServices ]
then
<query id="3">
<Select Path="Microsoft-Windows-TerminalServices-SessionBroker-Client/Operational">*</Select>
</query>

However I’m having a hard time translating a lot of the “if statements” I see to NxLog query formats… anyone have any resources or tips to guide me?

Here’s what I tried, obviously wrong, <Exec> cannot be in <QueryList>

<Exec>
if ($Channel == 'Microsoft-Windows-TerminalServices-SessionBroker/Operational')
	<Query id="3">
	<Select Path="Microsoft-Windows-TerminalServices-SessionBroker/Operational">*</Select>
	</Query>
</Exec>

Thanks for your help.

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.