IIS 7 and Above
Change log file delimiter?
Last post Sep 29, 2015 09:46 PM by Ziggy Nemeth
Sep 11, 2012 01:29 PMemail@example.com|LINK
Sep 11, 2012 09:10 PM|qbernard|LINK
Jan 31, 2013 01:27 PM|jonesch9|LINK
Did you ver find a way to use a log file delimiter? I would like to use a pipe if possible.
Jul 26, 2013 02:33 PM|pleitao|LINK
Anyone ever find a solution to this? I would like to change the delimiter as well. Some fields contain spaces and it's breaking my parsers.
Jul 31, 2013 02:50 PM|jonesch9|LINK
We have never found a resolution to this. It would be nice in the advanced logging module if you could set an advanced delimiter (double quote qualified pipes) so you don’t end up with delimiters in your logs. I would think if a product team was put together
to develop an advanced logging module and they had somebody who actually works with logs that this should be a major requirement. You really can’t even use the IIS advanced logging module because of this. Maybe somebody should create a ticket with Microsoft.
Aug 05, 2013 03:13 PM|pleitao|LINK
Thanks to a coworker for pointing it out, my backup copy of IISAdvancedLogging_schema.xml was being read and overriding my changes to the file (I guess all files in the schema directory are read, no matter the name). It was possible to for me to set a delimiter
in the logs by doing the following:
Modify this line:
-- <attribute name="delimiter" type="string" defaultValue="
++ <attribute name="delimiter" type="string" defaultValue="	" />
Change the "defaultValue" to anything you'd like. You can't use control characters such as \t as the value (it will literally use \t as a delimiter). You'll need to use HTML coded character sets, go figure.
Using the xm_csv module in nxlog, I'm able to specify "Delimiter \t" to use tab as a delimiter. nxlog can then convert the entire line to JSON and I'm able to send those events to logstash.
Aug 08, 2013 12:13 PM|pleitao|LINK
Edited post. I have things working well now using the method above.
Aug 21, 2013 05:38 PM|pjhanson|LINK
LogParser has a commandline argument for this when using -i:IISW3C
-dQuotes ON|OFF : Double-quoted strings [default value=OFF]
An example would look something like:
LogParser.exe -i:IISW3C -dQuotes:ON "SELECT * INTO Datagrid FROM Logfile.log"
Sep 29, 2015 09:46 PM|Ziggy Nemeth|LINK
Another way which doesn't require Advanced Logging is to enable Event logging for the IIS site, then all W3C fields are seperated in the event in XML which you can easily parse in PowerShell.