# Convert the IIS logs to JSON and use the original event time
<Input IIS_Site>
    Module    im_file
    File    "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex*"
    SavePos  TRUE
 
    Exec if $raw_event =~ /^#/ drop();          \
       else                                     \
       {                                        \
            w3c->parse_csv();                   \
            $SourceName = "IIS";                \
            $Message = $raw_event;              \
       }
</Input>
<Input IIS_Site_alt>
    Module    im_file
    File    "C:\\inetpub\\logs\\LogFiles\\W3SVC2\\u_ex*"
    SavePos  TRUE
 
    Exec if $raw_event =~ /^#/ drop();          \
       else                                     \
       {                                        \
            w3c->parse_csv();                   \
            $SourceName = "IIS";                \
            $Message = $raw_event;              \
       }
</Input>

<Output IIS-out>
    Module om_tcp
    Host NLS_SERVER_IP
    Port 5142
    Exec $tmpmessage = $Message; delete($Message); rename_field("tmpmessage","message");
	Exec $raw_event = to_json();
    # Uncomment for debug output
    # Exec file_write('%ROOT%\data\nxlog_output.log', $raw_event + "\n");
</Output>

<Route IIS>
    Path IIS_Site => IIS-out
	Path IIS_Site_alt => IIS-out
</Route>