Using NXLog with IIS and have json output - json

Question

I am trying to use nxlog to oarse the IIS files and create a JSON output so that I can later push it into logstash
However all I get is the raw data in the file and not the formatted output I was led to expect e.g. https://github.com/StephenHynes7/confs/blob/master/windows_iis_JSON/nxlog-iis.conf.
This is my config file
## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html
## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.
#define ROOT C:\Program Files\nxlog
define ROOT D:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension _syslog>
Module xm_syslog
</Extension>
<Extension json>
Module xm_json
</Extension>
# Select the input folder where logs will be scanned
# Create the parse rule for IIS logs. You can copy these from the header of the IIS log file.
# Uncomment Extension w3c for IIS logging
<Extension w3c>
Module xm_csv
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
Fields $date, $time, $s-sitename, $s-computername, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $cs-cookie, $cs-referrer, $cs-host, $sc-status, $sc-substatus, $sc-win32-status, $sc-bytes, $cs-bytes, $time-taken
FieldTypes string, string, string, string, string, string, string, string, integer, string, string, string, string, string, string, integer, integer, integer, integer, integer, integer
Delimiter ' '
UndefValue -
QuoteChar '"'
EscapeControl FALSE
</Extension>
<Input iis_logs>
Module im_file
File "C:\\Resources\\Directory\\\\u_ex*.log"
ReadFromLast True
Recursive True
SavePos True
Exec if $raw_event =~ /^#/ drop(); \
else \
{ \
w3c->parse_csv(); \
$EventTime = parsedate($date + " " + $time); \
$SourceName = "IIS"; \
$Message = to_json(); \
}
</Input>
<Output debug>
Module om_file
File "C:\\nxlog-debug.txt"
</Output>
<Route 1>
Path iis_logs => debug
</Route>
and my output (not json)
2015-09-05 07:42:00 W3SVC1273337584 ****** *.*.*.* GET / - 443 - *.*.*.* HTTP/1.1 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) - - *.*.*.* 403 14 0 5530 258 31
2015-09-05 07:42:00 W3SVC1273337584 ****** *.*.*.* GET / - 443 - *.*.*.* HTTP/1.1 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) - - *.*.*.* 403 14 0 5530 258 16
2015-09-05 07:53:05 W3SVC1273337584 ****** *.*.*.* GET / - 443 - *.*.*.* HTTP/1.1 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) - - *.*.*.* 403 14 0 5530 258 31
2015-09-05 07:53:06 W3SVC1273337584 ****** *.*.*.* GET / - 443 - *.*.*.* HTTP/1.1 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.2;+WOW64;+Trident/6.0) - - *.*.*.* 403 14 0 5530 258 31
I assume I am close but what am I missing?

Answer 1

om_file writes $raw_event into the output by default and all other fields are discarded including $Message. So you need either
$raw_event = to_json();
or simply just
to_json();
The two are equivalent.