Perl (im_perl)

The Perl programming language is widely used for log processing and comes with a broad set of modules bundled or available from CPAN. Code can be written more quickly in Perl than in C, and code execution is safer because exceptions (croak/die) are handled properly and will only result in an unfinished attempt at log processing rather than taking down the whole NXLog process.

To examine the supported platforms, see the list of installer packages in the Available Modules chapter.

This module makes it possible to execute Perl code in an input module to capture and inject event data directly into NXLog. See also the om_perl and xm_perl modules.

The module will parse the file specified in the PerlCode directive when NXLog starts the module. The Perl code must implement the read_data subroutine which will be called by the module. To generate event data, the Log::Nxlog Perl module must be included, which provides the following methods.

To use the im_perl module on Windows, a separate Perl environment must be installed, such as Strawberry Perl. Currently, the im_perl module on Windows requires Strawberry Perl 5.28.2.1.

log_debug(msg): Send the message msg to the internal logger on DEBUG log level. This method does the same as the log_debug() procedure in NXLog.
log_info(msg): Send the message msg to the internal logger on INFO log level. This method does the same as the log_info() procedure in NXLog.
log_warning(msg): Send the message msg to the internal logger on WARNING log level. This method does the same as the log_warning() procedure in NXLog.
log_error(msg): Send the message msg to the internal logger on ERROR log level. This method does the same as the log_error() procedure in NXLog.
add_input_data(event): Pass the event record to the next module instance in the route. Failure to call this method will result in a memory leak.
logdata_new(): Create a new event record. The return value can be used with the set_field_*() methods to insert data.
set_field_boolean(event, key, value): Set the boolean value in the field named key.
set_field_integer(event, key, value): Set the integer value in the field named key.
set_field_string(event, key, value): Set the string value in the field named key.
set_read_timer(delay): Set the timer in seconds to invoke the read_data method again.

The set_read_timer() method should be called in order to invoke read_data again. This is typically used for polling data. The read_data method must not block.

For the full NXLog Perl API, see the POD documentation in Nxlog.pm. The documentation can be read with perldoc Log::Nxlog.

Configuration

The im_perl module accepts the following directives in addition to the common module directives.

PerlCode

This mandatory directive expects a file containing valid Perl code that implements the read_data subroutine. This file is read and parsed by the Perl interpreter.

On Windows, the Perl script invoked by the PerlCode directive must define the Perl library paths at the beginning of the script to provide access to the Perl modules.

nxlog-windows.pl

use lib 'c:\Program Files\nxlog\data';

Config

This optional directive allows you to pass configuration strings to the script file defined by the PerlCode directive. This is a block directive and any text enclosed within <Config></Config> is submitted as a single string literal to the Perl code.

If you pass several values using this directive (for example, separated by the \n delimiter) be sure to parse the string correspondingly inside the Perl code.

Call: This optional directive specifies the Perl subroutine to invoke. With this directive, you can call only specific subroutines from your Perl code. If the directive is not specified, the default subroutine read_data is invoked.

Examples

Example 1. Using im_perl to Generate Event Data

In this example, logs are generated by a Perl function that increments a counter and inserts it into the generated line.

nxlog.conf

<Output file2>
    Module    om_file
    File      'tmp/output2'
</Output>


<Input perl>
    Module    im_perl
    PerlCode  "modules/input/perl/perl-input.pl"
    Call read_data1
</Input>

<Input perl2>
    Module  im_perl
    PerlCode  "modules/input/perl/perl-input2.pl"
</Input>

<Route r1>
    Path perl => file
</Route>

<Route r2>
    Path perl2 => file2
</Route>

perl-input.pl

use strict;
use warnings;

use Log::Nxlog;

my $counter;

sub read_data1
{
    my $event = Log::Nxlog::logdata_new();
    $counter //= 1;
    my $line = "Input1: this is a test line ($counter) that should appear in the output";
    $counter++;
    Log::Nxlog::set_field_string($event, 'raw_event', $line);
    Log::Nxlog::add_input_data($event);
    if ( $counter <= 100 )
    {
        Log::Nxlog::set_read_timer(0);
    }
}