Collect logs from Microsoft SQL Server

<Extension charconv>
    Module               xm_charconv
    LineReader           UTF-16LE
</Extension>

define ERRORLOG_EVENT    /(?x)^(\xEF\xBB\xBF)? \
                         (?<EventTime>\d+-\d+-\d+\ \d+:\d+:\d+.\d+) \
                         \ (?<Source>\S+)\s+(?<Message>.+)$/s
<Input mssql_error>
    Module               im_file
    File                 'C:\Program Files\Microsoft SQL Server\' + \
                         'MSSQL14.MSSQLSERVER\MSSQL\Log\ERRORLOG'
    InputType            charconv
    <Exec>
        # Attempt to match regular expression
        if $raw_event =~ %ERRORLOG_EVENT%
        {
            # Check if previous lines were saved
            if defined(get_var('saved'))
            {
                $tmp = $raw_event;
                $raw_event = get_var('saved');
                set_var('saved', $tmp);
                delete($tmp);
                # Process and send previous event
                $raw_event =~ %ERRORLOG_EVENT%;
                $EventTime = parsedate($EventTime);
            }
            # Save this line to module variable until the next event
            else
            {
                set_var('saved', $raw_event);
                drop();
            }
        }
        # Save this line to module variable until the next event
        else
        {
            set_var('saved', get_var('saved') + "\n" + $raw_event);
            drop();
        }
    </Exec>
</Input>

<Extension charconv>
    Module    xm_charconv
</Extension>

<Input mssql_error>
    Module    im_file
    File      'C:\Program Files\Microsoft SQL Server\' + \
              'MSSQL14.MSSQLSERVER\MSSQL\Log\ERRORLOG'
    <Exec>
        # Convert character encoding
        $raw_event = convert($raw_event, 'UTF-16LE', 'UTF-8');
        # Discard empty lines
        if $raw_event == '' drop();
        # Attempt to match regular expression
        else if $raw_event =~ /(?x)^(?<EventTime>\d+-\d+-\d+\ \d+:\d+:\d+.\d+)
                              \ (?<Source>\S+)\s+(?<Message>.+)$/s
        {
            # Convert $EventTime field to datetime type
            $EventTime = parsedate($EventTime);
            # Save $EventTime and $Source; may be needed for next event
            set_var('last_EventTime', $EventTime);
            set_var('last_Source', $Source);
        }
        # If regular expression does not match, this is a multi-line event
        else
        {
            # Use the entire line for the $Message field
            $Message = $raw_event;
            # Check if fields were save from the previous event
            if defined(get_var('last_EventTime'))
            {
                # Use $EventTime and $Source from previous event
                $EventTime = get_var('last_EventTime');
                $Source = get_var('last_Source');
            }
            else
                # Use received timestamp for $EventTime; $Source is unknown
                $EventTime = $EventReceivedTime;
        }
    </Exec>
</Input>

CREATE TABLE dbo.test1 (
    RecordID int IDENTITY(1,1) NOT NULL,
    EventTime datetime2 NOT NULL,
    Message varchar(100) NOT NULL,
)

INSERT INTO dbo.test1 (EventTime, Message)
VALUES ('2023-06-27T00:00:00', 'This is a test message');
GO

<Extension json>
    Module              xm_json
</Extension>

<Input mssql>
    Module              im_odbc
    ConnectionString    Driver={ODBC Driver 17 for SQL Server}; Server=MSSQL-HOST; \
                        Trusted_Connection=yes; Database=TESTDB
    SQL                 SELECT RecordID AS id, * FROM dbo.test1 WHERE RecordID > ?
    Exec                delete($id);
    Exec                to_json();
</Input>

{
  "RecordID": 1,
  "EventTime": "2023-06-27T23:00:00.000000Z",
  "Message": "This is a test message",
  "EventReceivedTime": "2023-06-27T23:00:54.313071Z",
  "SourceModuleName": "mssql",
  "SourceModuleType": "im_odbc"
}

CREATE TABLE dbo.test1 (
    EventTime datetime2 NOT NULL,
    Message varchar(100) NOT NULL,
)

INSERT INTO dbo.test1 (EventTime, Message)
VALUES ('2023-06-27T00:00:00', 'This is a test message');
GO

<Input mssql>
    Module              im_odbc
    ConnectionString    Driver={ODBC Driver 17 for SQL Server}; Server=MSSQL-HOST; \
                        Trusted_Connection=yes; Database=TESTDB
    IdType              timestamp
    SQL                 SELECT EventTime AS id, * FROM dbo.test1 WHERE EventTime > ?
    Exec                delete($id);
</Input>

CREATE TABLE dbo.test1 (
    EventTime datetimeoffset NOT NULL,
    Message varchar(100) NOT NULL,
)

INSERT INTO dbo.test1 (EventTime, Message)
VALUES ('2023-06-27T00:00:00+01:00', 'This is a test message');
GO

<Input mssql>
    Module              im_odbc
    ConnectionString    Driver={ODBC Driver 17 for SQL Server}; Server=MSSQL-HOST; \
                        Trusted_Connection=yes; Database=TESTDB
    IdType              timestamp
    SQL                 SELECT CAST(EventTime AS datetime2) AS id, Message FROM dbo.test1 \
                        WHERE EventTime > ?
    Exec                delete($id);
</Input>

CREATE TABLE dbo.test1 (
    EventTime datetime NOT NULL,
    Message varchar(100) NOT NULL,
)

INSERT INTO dbo.test1 (EventTime, Message)
VALUES ('2023-06-27T00:00:00.333', 'This is a test message');
GO

<Input mssql>
    Module              im_odbc
    ConnectionString    Driver={ODBC Driver 17 for SQL Server}; Server=MSSQL-HOST; \
                        Trusted_Connection=yes; Database=TESTDB
    IdType              timestamp
    SQL                 SELECT EventTime AS id, * FROM dbo.test1 \
                        WHERE EventTime > CAST(? as datetime)
    Exec                delete($id);
</Input>

CREATE TABLE dbo.test1 (
    RowVersion timestamp NOT NULL,
    Message varchar(100) NOT NULL,
)

INSERT INTO dbo.test1 (Message)
VALUES ('This is a test message');
GO

<Input mssql>
    Module              im_odbc
    ConnectionString    Driver={ODBC Driver 17 for SQL Server}; Server=MSSQL-HOST; \
                        Trusted_Connection=yes; Database=TESTDB
    SQL                 SELECT RowVersion AS id, * FROM dbo.test1 WHERE RowVersion > ?
    Exec                delete($id);
</Input>

CREATE TABLE dbo.test1 (
    RecordID int IDENTITY(1,1) NOT NULL,
    EventTime datetime2 NOT NULL,
    Message varchar(100) NOT NULL,
)

<Output mssql>
    Module              om_odbc
    ConnectionString    Driver={ODBC Driver 17 for SQL Server}; Server=MSSQL-HOST; \
                        Trusted_Connection=yes; Database=TESTDB
    SQL                 "INSERT INTO dbo.test1 (EventTime, Message) VALUES (?,?)", \
                        $EventTime, $Message
</Output>