NXLOG日志传送中缺少消息 [英] Message missing in NXLOG log shipping

问题描述

我在ERRORLOG文件中有以下SQL日志，

I have following SQL logs in ERRORLOG file,

2014-12-19 14:27:21.76 spid52      Starting up database 'MyDatabase'.
2014-12-19 14:27:22.06 spid52      Setting database option COMPATIBILITY_LEVEL to 110 for database 'MyDatabase'.
2014-12-19 14:27:22.06 spid52      Setting database option ANSI_NULL_DEFAULT to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.06 spid52      Setting database option ANSI_NULLS to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option ANSI_PADDING to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option ANSI_WARNINGS to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option ARITHABORT to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option AUTO_CLOSE to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option AUTO_CREATE_STATISTICS to ON for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option AUTO_SHRINK to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option AUTO_UPDATE_STATISTICS to ON for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option CURSOR_CLOSE_ON_COMMIT to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option CURSOR_DEFAULT to GLOBAL for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option CONCAT_NULL_YIELDS_NULL to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option NUMERIC_ROUNDABORT to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.09 spid52      Setting database option QUOTED_IDENTIFIER to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option RECURSIVE_TRIGGERS to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option DISABLE_BROKER to ON for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option AUTO_UPDATE_STATISTICS_ASYNC to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option DATE_CORRELATION_OPTIMIZATION to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option PARAMETERIZATION to SIMPLE for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option READ_COMMITTED_SNAPSHOT to OFF for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option READ_WRITE to ON for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option RECOVERY to FULL for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option MULTI_USER to ON for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option PAGE_VERIFY to CHECKSUM for database 'MyDatabase'.
2014-12-19 14:27:22.10 spid52      Setting database option target_recovery_time to 0 for database 'MyDatabase'.

我已经在nxlog中使用以下代码将日志发送到Logstash.

I have used the following code in nxlog to ship the logs to Logstash..

<Input sql-ERlogs>
    Module      im_file
    File 'C:\Program Files\Microsoft SQL Server\MSSQL11.SQL\MSSQL\Log\ER*'
    ReadFromLast TRUE
    Exec        to_json();
</Input>

我仅在kibana中收到以下消息.

I am receiving following messages only in kibana..

{"message":"{\"EventReceivedTime\":\"2014-12-19 14:52:50\",\"SourceModuleName\":\"sql-ERlogs\",\"SourceModuleType\":\"im_file\"}\r","@version":"1","@timestamp":"2014-12-19T09:21:11.709Z","host":"192.168.1.9:1426","type":"sqllogs"}

这里我只有时间来自此日志..为什么此日志中没有消息，我的意思是为什么Starting up database 'MyDatabase'.不存在.我的日志传送方式有什么问题吗?

here I have the time only from this log.. Why there is no messages from this log, I mean why Starting up database 'MyDatabase'. not there. Is there any wrong in my log shipping way.

更新 更新@ b0ti答案后，我得到以下输出

Update After update the @b0ti answer I am get the following output

{"EventReceivedTime":"2014-12-19 15:50:36","SourceModuleName":"sql-ERlogs","SourceModuleType":"im_file","Message":"2\u00000\u00001\u00004\u0000-\u00001\u00002\u0000-\u00001\u00009\u0000 \u00001\u00005\u0000:\u00005\u00000\u0000:\u00003\u00006\u0000.\u00003\u00000\u0000 \u0000s\u0000p\u0000i\u0000d\u00005\u00002\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000S\u0000e\u0000t\u0000t\u0000i\u0000n\u0000g\u0000 \u0000d\u0000a\u0000t\u0000a\u0000b\u0000a\u0000s\u0000e\u0000 \u0000o\u0000p\u0000t\u0000i\u0000o\u0000n\u0000 \u0000R\u0000E\u0000C\u0000O\u0000V\u0000E\u0000R\u0000Y\u0000 \u0000t\u0000o\u0000 \u0000F\u0000U\u0000L\u0000L\u0000 \u0000f\u0000o\u0000r\u0000 \u0000d\u0000a\u0000t\u0000a\u0000b\u0000a\u0000s\u0000e\u0000 \u0000'\u0000S\u0000a\u0000m\u0000p\u0000l\u0000e\u0000'\u0000.\u0000"}

为什么消息以Unicode字符形式出现，如何将其更改为消息?

Why the message is comes as Unicode characters, how can I change it as message?

推荐答案

通过为charconv添加扩展名，我得到了解决方案.

By adding extension for charconv I got the solution.

扩展代码，

<Extension charconv>
    Module xm_charconv
    AutodetectCharsets utf-8, euc-jp, utf-16, utf-32, iso8859-2
</Extension>

并按如下所示修改input，

<Input sql-ERlogs>
    Module      im_file
    File 'C:\Program Files\Microsoft SQL Server\MSSQL11.SQL\MSSQL\Log\ER*'
    ReadFromLast TRUE
    Exec        convert_fields("AUTO", "utf-8");
</Input>

现在，我的日志非常完美.

Now I got the log as perfectly.

我希望此解决方案对需要解决方案的人有所帮助.

I hope this solution will be helpful for someone who needs solution.

谢谢.

这篇关于NXLOG日志传送中缺少消息的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！