Custom Plugins

Log Parser allows users to develop custom input formats and use them with both the command-line Log Parser executable and with the Log Parser scriptable COM components.

There is no requirement on the language that can be used to implement a custom input format; for example, custom input formats can be implemented using any of the following languages:

C++
C#
Visual Basic®
JScript® or VBScript

Custom input formats are developed as COM objects implementing the methods of the ILogParserInputContext COM interface. There are two ways to write a COM object that implements the methods of this interface: implementing the ILogParserInputContext interface directly, or implementing the IDispatch (Automation) interface exposing the methods of the ILogParserInputContext interface.

Implementing the ILogParserInputContext Interface Directly

With this method, a Log Parser custom input format COM object must implement the ILogParserInputContext interface directly.
This method usually requires writing C++ or Visual Basic code.

Implementing the IDispatch Interface Exposing the ILogParserInputContext Interface Methods

With this method, a Log Parser custom input format COM object must implement the IDispatch interface, and support the same methods exposed by the ILogParserInputContext interface. This method usually requires writing scriptlets (.wsc) files in JScript or VBScript.
COM input format plugins that implement the IDispatch interface can also support custom properties.

Custom input format COM objects must be registered with the COM infrastructure in order to be accessible by Log Parser. This task can be usually achieved using the regsvr32.exe tool distributed with the Windows OS. The following command registers a custom input format COM object implemented as a dynamic link library (dll):

C:\>regsvr32 myinputformat.dll

The following command registers a custom input format COM object implemented as a scriptlet JScript or VBScript file:

C:\>regsvr32 myinputformat.wsc

Once developed and registered with the COM infrastructure, custom input formats can be used with either the command-line Log Parser executable, or with the Log Parser scriptable COM components.

Using Custom Input Formats with the Command-Line Log Parser Executable

With the command-line Log Parser executable, custom input formats are used through the COM input format, which allows users to specify the ProgID of the custom COM object and eventual run-time properties.

As an example, let's assume that we have just developed a custom input format, and that its ProgID is "MySample.MyInputFormat".
With the COM input format, the custom COM object can be used as follows:

C:\>logparser "SELECT * FROM inputfile" -i:COM -iProgID:MySample.MyInputFormat

In the example above, "inputfile" stands for the specific from-entity recognized by the custom input format.

If we implemented our COM object through an Automation interface, we could also have our object support custom properties, and set them through the COM input format as shown in the following example:

C:\>logparser "SELECT * FROM inputfile" -i:COM -iProgID:MySample.MyInputFormat -iCOMParams:ExtendedFields=on

For more information on the COM input format, refer to the COM Input Format reference.

Using Custom Input Formats with the Log Parser Scriptable COM Components

With the Log Parser scriptable COM components, custom input format objects are passed as the inputFormat argument to the Execute or ExecuteBatch methods of the LogQuery object.

The following VBScript example shows how our "MySample.MyInputFormat" custom COM object can be used with the Log Parser scriptable COM components:

Dim oLogQuery
Dim oMyInputFormat
Dim oCSVOutputFormat 
Dim strQuery

Set oLogQuery = CreateObject("MSUtil.LogQuery")

' Create our custom Input Format object
Set oMyInputFormat = CreateObject("MySample.MyInputFormat")

' Create Output Format object
Set oCSVOutputFormat = CreateObject("MSUtil.LogQuery.CSVOutputFormat")
oCSVOutputFormat.tabs = TRUE

' Create query text
strQuery = "SELECT TimeGenerated, EventID INTO C:\output.csv FROM System"
strQuery = strQuery & " WHERE SourceName = 'Application Popup'"

' Execute query
oLogQuery.ExecuteBatch strQuery, oMyInputFormat, oCSVOutputFormat

For more information on the Log Parser scriptable COM components, see Log Parser COM API Overview, and COM API Reference.

Custom Input Format Samples

Log Parser comes with three custom input format samples, located in the "Samples\COM" folder:

Processes: this sample shows how to write a custom input format using the C++ language;
BooksXML: this sample shows how to write a custom input format that parses XML documents, using the C# language;
QFE: this sample shows how to write a custom input format that returns information gathered through a WMI query, using the VBScript language.

For more information on custom input format plugins and the ILogParserInputContext interface, refer to the COM Input Format Plugins reference.