Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set this up (http://www.canopsis.org/2013/03/central-syslog-server-nxlog-logstash-kibana/) and am getting this error when I start nxlog:

2013-12-20 10:36:37 ERROR Couldn't parse Exec block at /etc/nxlog/nxlog.conf:21;couldn't parse statement at line 21, character 42 in /etc/nxlog/nxlog.conf;procedure 'to_json()' does not exist or takes different arguments

Any idea what is wrong? This is my config for nxlog

<Extension snare>
    Module  xm_csv
    Fields   $id1, $id2, $id3, $id4, $id5, $id6, $id7, $id8, $id9, $id10, $id11, $id12, $id13, $id14, $id15, $id16
    Delimiter   \t
</Extension>

<Extension charconv>
    Module  xm_charconv
    AutodetectCharsets utf-8, utf-16, utf-32, iso8859-2, windows-1252
</Extension>

<Extension gelf>
    Module  xm_gelf
</Extension>

<Input in_snare>
    Module      im_udp
    Host        0.0.0.0
    Port        6161
    Exec   convert_fields("windows-1252", "utf-8");
    Exec        snare->parse_csv(); to_json();
</Input>

<Output out_gelf> 
    Module  om_udp
    Host    localhost
    Port    12201
    OutputType  GELF
</Output>

<Route _snare>
    Path  in_snare => out_file1, out_gelf
</Route>
share|improve this question
up vote 2 down vote accepted

You forgot the json extension module:

<Extension json>
    Module      xm_json
</Extension>
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .