nxlog process logs files based on filename - nxlog

Question

I have lots of log files in C:\Logs.
I have IIS logs in each individual site folder (W3SVCXX, where XX is site id from IIS) but inside this same C:\Logs\ folder I have other log files from those same websites but logged via Log4Net as part of the application running at the website.
My current NXLog Config:
<Input i_IISSITES>
Module im_file
File "C:\Logs\u_ex*"
SavePos TRUE
Recursive TRUE
InputType LineBased
Exec $Hostname = 'stg-01-iom';
Exec if $raw_event =~ /^#/ drop(); \
else \
{ \
w3c->parse_csv(); \
$SourceName = "IIS"; \
$EventTime = parsedate($date + " " + $time); \
$Message = to_json(); \
}
</Input>
<Output o_PLAINTEXT>
Module om_udp
Host 10.50.108.32
Port 5555
</Output>
<Route r_IIS>
Path i_IISSITES => o_PLAINTEXT
</Route>
This works perfectly currently for IIS logs which match the filename U_ex*.
Folder structure:
c:\Logs\
- L009
- Dir1
- Dir2
- FileName.Log
- L008
- Dir3
- RandomFileName.Log
- L008
- W3SVC1
- u_ex1232.log
- W3SVC2
- W3SVC3
etc etc..
Now I'm able to be specific for IIS logs because the filename is u_ex* but with my other log files they could be called anything.
So for my other input I need to be able to target all .log but not u_ex.log.
Any ideas?
Thanks,
Michael

Answer 1

If you need to process all logs then instead of defining two input instances you could just use one and parse differently depending on the file name:
<Exec>
if file_name() =~ /u_ex\d+\.log$/
{
# parse as IIS
}
else
{
# parse as other
}
</Exec>