Updated uninstaller to match new installer.

Rolled Udp input listener support to ipv4 only.

.gitignore

@@ -155,3 +155,4 @@ $RECYCLE.BIN/
 # Mac desktop service store files
 .DS_Store
 packages
+*.msi

.nuget/NuGet.Config

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <solution>
+    <add key="disableSourceControlIntegration" value="true" />
+  </solution>
+</configuration>

.nuget/NuGet.targets

@@ -0,0 +1,144 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+    <PropertyGroup>
+        <SolutionDir Condition="$(SolutionDir) == '' Or $(SolutionDir) == '*Undefined*'">$(MSBuildProjectDirectory)\..\</SolutionDir>
+
+        <!-- Enable the restore command to run before builds -->
+        <RestorePackages Condition="  '$(RestorePackages)' == '' ">false</RestorePackages>
+
+        <!-- Property that enables building a package from a project -->
+        <BuildPackage Condition=" '$(BuildPackage)' == '' ">false</BuildPackage>
+
+        <!-- Determines if package restore consent is required to restore packages -->
+        <RequireRestoreConsent Condition=" '$(RequireRestoreConsent)' != 'false' ">true</RequireRestoreConsent>
+
+        <!-- Download NuGet.exe if it does not already exist -->
+        <DownloadNuGetExe Condition=" '$(DownloadNuGetExe)' == '' ">false</DownloadNuGetExe>
+    </PropertyGroup>
+
+    <ItemGroup Condition=" '$(PackageSources)' == '' ">
+        <!-- Package sources used to restore packages. By default, registered sources under %APPDATA%\NuGet\NuGet.Config will be used -->
+        <!-- The official NuGet package source (https://www.nuget.org/api/v2/) will be excluded if package sources are specified and it does not appear in the list -->
+        <!--
+            <PackageSource Include="https://www.nuget.org/api/v2/" />
+            <PackageSource Include="https://my-nuget-source/nuget/" />
+        -->
+    </ItemGroup>
+
+    <PropertyGroup Condition=" '$(OS)' == 'Windows_NT'">
+        <!-- Windows specific commands -->
+        <NuGetToolsPath>$([System.IO.Path]::Combine($(SolutionDir), ".nuget"))</NuGetToolsPath>
+    </PropertyGroup>
+
+    <PropertyGroup Condition=" '$(OS)' != 'Windows_NT'">
+        <!-- We need to launch nuget.exe with the mono command if we're not on windows -->
+        <NuGetToolsPath>$(SolutionDir).nuget</NuGetToolsPath>
+    </PropertyGroup>
+
+    <PropertyGroup>
+        <PackagesProjectConfig Condition=" '$(OS)' == 'Windows_NT'">$(MSBuildProjectDirectory)\packages.$(MSBuildProjectName.Replace(' ', '_')).config</PackagesProjectConfig>
+        <PackagesProjectConfig Condition=" '$(OS)' != 'Windows_NT'">$(MSBuildProjectDirectory)\packages.$(MSBuildProjectName).config</PackagesProjectConfig>
+    </PropertyGroup>
+
+    <PropertyGroup>
+      <PackagesConfig Condition="Exists('$(MSBuildProjectDirectory)\packages.config')">$(MSBuildProjectDirectory)\packages.config</PackagesConfig>
+      <PackagesConfig Condition="Exists('$(PackagesProjectConfig)')">$(PackagesProjectConfig)</PackagesConfig>
+    </PropertyGroup>
+    
+    <PropertyGroup>
+        <!-- NuGet command -->
+        <NuGetExePath Condition=" '$(NuGetExePath)' == '' ">$(NuGetToolsPath)\NuGet.exe</NuGetExePath>
+        <PackageSources Condition=" $(PackageSources) == '' ">@(PackageSource)</PackageSources>
+
+        <NuGetCommand Condition=" '$(OS)' == 'Windows_NT'">"$(NuGetExePath)"</NuGetCommand>
+        <NuGetCommand Condition=" '$(OS)' != 'Windows_NT' ">mono --runtime=v4.0.30319 "$(NuGetExePath)"</NuGetCommand>
+
+        <PackageOutputDir Condition="$(PackageOutputDir) == ''">$(TargetDir.Trim('\\'))</PackageOutputDir>
+
+        <RequireConsentSwitch Condition=" $(RequireRestoreConsent) == 'true' ">-RequireConsent</RequireConsentSwitch>
+        <NonInteractiveSwitch Condition=" '$(VisualStudioVersion)' != '' AND '$(OS)' == 'Windows_NT' ">-NonInteractive</NonInteractiveSwitch>
+
+        <PaddedSolutionDir Condition=" '$(OS)' == 'Windows_NT'">"$(SolutionDir) "</PaddedSolutionDir>
+        <PaddedSolutionDir Condition=" '$(OS)' != 'Windows_NT' ">"$(SolutionDir)"</PaddedSolutionDir>
+
+        <!-- Commands -->
+        <RestoreCommand>$(NuGetCommand) install "$(PackagesConfig)" -source "$(PackageSources)"  $(NonInteractiveSwitch) $(RequireConsentSwitch) -solutionDir $(PaddedSolutionDir)</RestoreCommand>
+        <BuildCommand>$(NuGetCommand) pack "$(ProjectPath)" -Properties "Configuration=$(Configuration);Platform=$(Platform)" $(NonInteractiveSwitch) -OutputDirectory "$(PackageOutputDir)" -symbols</BuildCommand>
+
+        <!-- We need to ensure packages are restored prior to assembly resolve -->
+        <BuildDependsOn Condition="$(RestorePackages) == 'true'">
+            RestorePackages;
+            $(BuildDependsOn);
+        </BuildDependsOn>
+
+        <!-- Make the build depend on restore packages -->
+        <BuildDependsOn Condition="$(BuildPackage) == 'true'">
+            $(BuildDependsOn);
+            BuildPackage;
+        </BuildDependsOn>
+    </PropertyGroup>
+
+    <Target Name="CheckPrerequisites">
+        <!-- Raise an error if we're unable to locate nuget.exe  -->
+        <Error Condition="'$(DownloadNuGetExe)' != 'true' AND !Exists('$(NuGetExePath)')" Text="Unable to locate '$(NuGetExePath)'" />
+        <!--
+        Take advantage of MsBuild's build dependency tracking to make sure that we only ever download nuget.exe once.
+        This effectively acts as a lock that makes sure that the download operation will only happen once and all
+        parallel builds will have to wait for it to complete.
+        -->
+        <MsBuild Targets="_DownloadNuGet" Projects="$(MSBuildThisFileFullPath)" Properties="Configuration=NOT_IMPORTANT;DownloadNuGetExe=$(DownloadNuGetExe)" />
+    </Target>
+
+    <Target Name="_DownloadNuGet">
+        <DownloadNuGet OutputFilename="$(NuGetExePath)" Condition=" '$(DownloadNuGetExe)' == 'true' AND !Exists('$(NuGetExePath)')" />
+    </Target>
+
+    <Target Name="RestorePackages" DependsOnTargets="CheckPrerequisites">        
+        <Exec Command="$(RestoreCommand)"
+              Condition="'$(OS)' != 'Windows_NT' And Exists('$(PackagesConfig)')" />
+
+        <Exec Command="$(RestoreCommand)"
+              LogStandardErrorAsError="true"
+              Condition="'$(OS)' == 'Windows_NT' And Exists('$(PackagesConfig)')" />
+    </Target>
+
+    <Target Name="BuildPackage" DependsOnTargets="CheckPrerequisites">
+        <Exec Command="$(BuildCommand)"
+              Condition=" '$(OS)' != 'Windows_NT' " />
+
+        <Exec Command="$(BuildCommand)"
+              LogStandardErrorAsError="true"
+              Condition=" '$(OS)' == 'Windows_NT' " />
+    </Target>
+
+    <UsingTask TaskName="DownloadNuGet" TaskFactory="CodeTaskFactory" AssemblyFile="$(MSBuildToolsPath)\Microsoft.Build.Tasks.v4.0.dll">
+        <ParameterGroup>
+            <OutputFilename ParameterType="System.String" Required="true" />
+        </ParameterGroup>
+        <Task>
+            <Reference Include="System.Core" />
+            <Using Namespace="System" />
+            <Using Namespace="System.IO" />
+            <Using Namespace="System.Net" />
+            <Using Namespace="Microsoft.Build.Framework" />
+            <Using Namespace="Microsoft.Build.Utilities" />
+            <Code Type="Fragment" Language="cs">
+                <![CDATA[
+                try {
+                    OutputFilename = Path.GetFullPath(OutputFilename);
+
+                    Log.LogMessage("Downloading latest version of NuGet.exe...");
+                    WebClient webClient = new WebClient();
+                    webClient.DownloadFile("https://www.nuget.org/nuget.exe", OutputFilename);
+
+                    return true;
+                }
+                catch (Exception ex) {
+                    Log.LogErrorFromException(ex);
+                    return false;
+                }
+            ]]>
+            </Code>
+        </Task>
+    </UsingTask>
+</Project>

.nuget/packages.config

@@ -1,4 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <packages>
-  <package id="NUnit.Runners" version="2.6.3" />
+  <package id="Newtonsoft.Json" version="6.0.4" targetFramework="net40" />
+  <package id="NUnit.Runners" version="2.6.4" />
+  <package id="RapidRegex.Core" version="1.0.0.2" targetFramework="net40" />
+  <package id="System.Linq.Dynamic" version="1.0.4" targetFramework="net40" />
 </packages>

README.md

@@ -23,6 +23,9 @@ Please use the TimberWinR Google Group for discussion and support:
 
 https://groups.google.com/forum/#!forum/timberwinr
 
+Latest Build:
+
+![alt tag](https://ci.appveyor.com/api/projects/status/github/Cimpress-MCP/TimberWinR)
 
 ## Inputs
 The current supported Input format sources are:
@@ -33,6 +36,11 @@ The current supported Input format sources are:
  5. [Stdin](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/StdinInput.md) (Standard Input for Debugging)
  6. [W3C](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/W3CInput.md)(Internet Information Services W3C Advanced/Custom Format)
  7. [Udp](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/UdpInput.md) (listens for UDP on port for JSON messages)
+ 8. [TailFiles](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/TailFiles.md) (Tails log files efficiently *New*)
+
+## Codecs
+The current list of supported codecs are:
+ 1. [Multiline](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Codec.md)
 
 ## Filters
 The current list of supported filters are:
@@ -61,8 +69,7 @@ A single Json filter using the single tag (this is only provided as a convienien
     }
 ]
 ```
-
-Multiple Json filters must use the jsonFilters and array syntax
+Multiple Json filters must use the jsonFilters and array syntax, also mutateFilters, grokFilters, dateFilters, geoipFilters.
 ```json
 "Filters": [
     {
@@ -160,7 +167,7 @@ following options:
 TimberWinR.ServiceHost.exe -configFile:myconfig.json -logLevel:Debug
 ```
 
-## Automatic Installation via Chocolatey
+## Automatic Installation via Chocolatey (embedded)
 
 [TimbeWinR Chocolatey](https://chocolatey.org/packages/TimberWinR)
 
@@ -200,8 +207,8 @@ Options:
 -configFile:       Specifies the path to the JSON config file, or directory which contains .json file(s).
                    Default is -configFile:default.json
 -diagnosticPort:   Specifies the diagnostic port which can be used to get a health check of the service.
-                   Default Port is 5142, A value of 0 will disable it.  Open a browser
-                      http://localhost:5142
+                   Default Port is 5141, A value of 0 will disable it.  Open a browser
+                      http://localhost:5141
 ```
 #### -configFile
 This may be a single .json file or a directory containing .json file(s).  If it is a directory, all
@@ -212,8 +219,8 @@ order on disk.
 If you really just want to try it out, grab the binary distribution, extract the .zip file
 into a directory, e.g.  C:\TimberWinR
 
-Grab the [JSON example file](https://raw.githubusercontent.com/efontana/TimberWinR/master/TimberWinR.ServiceHost/default.json) and place it into C:\TimberWinR\default.json. 
-Edit the default.json file and change the Redis instance to match yours, replace 'tstlexiceapp006.vistaprint.svc' with the IP or DNS name
+Grab the [JSON example file](https://raw.githubusercontent.com/Cimpress-MCP/TimberWinR/master/TimberWinR.ServiceHost/default.json) and place it into C:\TimberWinR\default.json. 
+Edit the default.json file and change the Redis instance to match yours, replace 'tstlexiceapp006.mycompany.svc' with the IP or DNS name
 of the machine running redis.  Fire up the collector, enable the verbose debugging to see some Windows Events.
 
 ```

TimberWinR.ExtractID/Program.cs

@@ -99,9 +99,7 @@ namespace TimberWinR.ExtractID
                 Console.WriteLine("Updated {0} ProductID: {1}", args[2], productCode);
 
                 return 0;
-            }
-
-            Console.Error.WriteLine("Failed for some reason");
+            }           
         }
     }
 }

TimberWinR.ServiceHost/Program.cs

@@ -7,7 +7,9 @@ using System.Text;
 using System.Text.RegularExpressions;
 using System.Threading;
 using System.Threading.Tasks;
+using System.Xml;
 using Microsoft.Win32;
+
 using TimberWinR.Outputs;
 using TimberWinR.ServiceHost;
 using TimberWinR.Inputs;
@@ -26,6 +28,9 @@ namespace TimberWinR.ServiceHost
         
         private static void Main(string[] args)
         {
+
+           
+
             Arguments arguments = new Arguments();
            
             HostFactory.Run(hostConfigurator =>
@@ -38,7 +43,8 @@ namespace TimberWinR.ServiceHost
                     serviceConfigurator.WhenStarted(myService => myService.Start());
                     serviceConfigurator.WhenStopped(myService => myService.Stop());
                 });
-               
+
+                hostConfigurator.AddCommandLineDefinition("liveMonitor", c => arguments.LiveMonitor = bool.Parse(c.ToString()));
                 hostConfigurator.AddCommandLineDefinition("configFile", c => arguments.ConfigFile = c);
                 hostConfigurator.AddCommandLineDefinition("logLevel", c => arguments.LogLevel = c);
                 hostConfigurator.AddCommandLineDefinition("logDir", c => arguments.LogfileDir = c);
@@ -60,6 +66,7 @@ namespace TimberWinR.ServiceHost
                         AddServiceParameter("-configFile", arguments.ConfigFile);
                         AddServiceParameter("-logLevel", arguments.LogLevel);
                         AddServiceParameter("-logDir", arguments.LogfileDir);
+                        AddServiceParameter("-liveMonitor", arguments.LiveMonitor);
                         if (arguments.DiagnosticPort > 0)
                             AddServiceParameter("-diagnosticPort", arguments.DiagnosticPort);
                     }
@@ -68,8 +75,7 @@ namespace TimberWinR.ServiceHost
         }
 
         private static void AddServiceParameter(string paramName, string value)
-        {
-         
+        {         
             string currentValue = Registry.GetValue(KeyPath, KeyName, "").ToString();
 
             if (!string.IsNullOrEmpty(paramName) && !currentValue.Contains(string.Format("{0} ", paramName)))           
@@ -80,8 +86,7 @@ namespace TimberWinR.ServiceHost
         }
 
         private static void AddServiceParameter(string paramName, int value)
-        {
-    
+        {    
             string currentValue = Registry.GetValue(KeyPath, KeyName, "").ToString();
 
             if (!string.IsNullOrEmpty(paramName) && !currentValue.Contains(string.Format("{0}:", paramName)))
@@ -91,6 +96,16 @@ namespace TimberWinR.ServiceHost
             }
         }
 
+        private static void AddServiceParameter(string paramName, bool value)
+        {
+            string currentValue = Registry.GetValue(KeyPath, KeyName, "").ToString();
+
+            if (!string.IsNullOrEmpty(paramName) && !currentValue.Contains(string.Format("{0}:", paramName)))
+            {
+                currentValue += string.Format(" {0} \"{1}\"", paramName, value.ToString());
+                Registry.SetValue(KeyPath, KeyName, currentValue);
+            }
+        }
     }
 
     internal class Arguments
@@ -99,9 +114,10 @@ namespace TimberWinR.ServiceHost
         public string LogLevel { get; set; }
         public string LogfileDir { get; set; }
         public int DiagnosticPort { get; set; }
-
+        public bool LiveMonitor { get; set; }
         public Arguments()
         {
+            LiveMonitor = false;
             DiagnosticPort = 5141;
             ConfigFile = "default.json";
             LogLevel = "Info";
@@ -147,7 +163,7 @@ namespace TimberWinR.ServiceHost
         /// </summary>
         private void RunService()
         {
-            _manager = new TimberWinR.Manager(_args.ConfigFile, _args.LogLevel, _args.LogfileDir, _cancellationToken);
+            _manager = new TimberWinR.Manager(_args.ConfigFile, _args.LogLevel, _args.LogfileDir, _args.LiveMonitor, _cancellationToken);
             if (_args.DiagnosticPort > 0)
                 _diags = new Diagnostics.Diagnostics(_manager, _cancellationToken, _args.DiagnosticPort);
         }

TimberWinR.ServiceHost/Properties/AssemblyInfo.cs

@@ -32,5 +32,5 @@ using System.Runtime.InteropServices;
 // You can specify all the values or you can default the Build and Revision Numbers 
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.3.19.0")]
-[assembly: AssemblyFileVersion("1.3.19.0")]
+[assembly: AssemblyVersion("1.3.21.0")]
+[assembly: AssemblyFileVersion("1.3.21.0")]

TimberWinR.ServiceHost/TimberWinR.ServiceHost.csproj

@@ -12,6 +12,8 @@
     <TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
     <FileAlignment>512</FileAlignment>
     <TargetFrameworkProfile />
+    <SolutionDir Condition="$(SolutionDir) == '' Or $(SolutionDir) == '*Undefined*'">..\</SolutionDir>
+    <RestorePackages>true</RestorePackages>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <PlatformTarget>AnyCPU</PlatformTarget>
@@ -49,9 +51,8 @@
     <Reference Include="Microsoft.CSharp" />
     <Reference Include="System.Data" />
     <Reference Include="System.Xml" />
-    <Reference Include="Topshelf, Version=3.1.122.0, Culture=neutral, PublicKeyToken=b800c4cfcdeea87b, processorArchitecture=MSIL">
-      <SpecificVersion>False</SpecificVersion>
-      <HintPath>..\packages\Topshelf.3.1.3\lib\net40-full\Topshelf.dll</HintPath>
+    <Reference Include="Topshelf">
+      <HintPath>..\packages\Topshelf.3.1.4\lib\net40-full\Topshelf.dll</HintPath>
     </Reference>
   </ItemGroup>
   <ItemGroup>
@@ -87,6 +88,13 @@
     </ProjectReference>
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <Import Project="$(SolutionDir)\.nuget\NuGet.targets" Condition="Exists('$(SolutionDir)\.nuget\NuGet.targets')" />
+  <Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
+    <PropertyGroup>
+      <ErrorText>This project references NuGet package(s) that are missing on this computer. Enable NuGet Package Restore to download them.  For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
+    </PropertyGroup>
+    <Error Condition="!Exists('$(SolutionDir)\.nuget\NuGet.targets')" Text="$([System.String]::Format('$(ErrorText)', '$(SolutionDir)\.nuget\NuGet.targets'))" />
+  </Target>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">

TimberWinR.ServiceHost/config.json

@@ -90,7 +90,7 @@
                     "interval": 5000, 
                     "batch_count":  500,              
                     "host": [
-                        "tstlexiceapp006.vistaprint.svc"
+                        "tstlexiceapp006.mycompany.svc"
                     ]
                 }
             ],            
@@ -99,7 +99,7 @@
                     "threads":  1,   
                     "interval": 5000,                          
                     "host": [
-                        "tstlexiceapp003.vistaprint.svc"
+                        "tstlexiceapp003.mycompany.svc"
                     ]
                 }
             ]                           

TimberWinR.ServiceHost/default.json

@@ -18,7 +18,7 @@
         "Filters": [
             {
                 "grok": {
-                    "condition": "[EventTypeName] == \"Information Event\"",
+                    "condition": "\"[EventTypeName]\" == \"Information Event\"",
                     "match": [
                         "Text",
                         ""
@@ -33,7 +33,7 @@
                     "_comment": "Change the host to your Redis instance",
                     "port": 6379,
                     "host": [
-                        "logaggregator.vistaprint.svc"
+                        "logaggregator.mycompany.svc"
                     ]
                 }
             ]

TimberWinR.ServiceHost/packages.config

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <packages>
   <package id="RapidRegex.Core" version="1.0.0.2" targetFramework="net40" />
-  <package id="Topshelf" version="3.1.3" targetFramework="net40" />
+  <package id="Topshelf" version="3.1.4" targetFramework="net40" />
 </packages>

TimberWinR.TestGenerator/CommandLineOptions.cs

@@ -0,0 +1,82 @@
+using System.ComponentModel;
+using CommandLine;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using CommandLine.Text;
+
+namespace TimberWinR.TestGenerator
+{
+    class CommandLineOptions
+    {
+       // [Option('r', "read", Required = true, HelpText = "Input file to be processed.")]
+      //  public string InputFile { get; set; }
+        [Option("timberWinRConfig", DefaultValue = "default.json", HelpText = "Config file/directory to use")]
+        public string TimberWinRConfigFile { get; set; }
+
+        [Option("testDir", DefaultValue = ".", HelpText = "Test directory to use (created if necessary)")]
+        public string TestDir { get; set; }
+
+        [Option("testFile", DefaultValue = "", HelpText = "Config file/directory to use")]
+        public string TestFile { get; set; }
+
+        [Option("resultsFile", HelpText = "Expected results Results json file")]
+        public string ExpectedResultsFile { get; set; }
+
+        [Option('n', "numMessages", DefaultValue = 1000, HelpText = "The number of messages to send to the output(s)")]
+        public int NumMessages { get; set; }
+
+        [Option('l', "logLevel", DefaultValue = "debug", HelpText = "Logging Level Debug|Error|Fatal|Info|Off|Trace|Warn")]
+        public string LogLevel { get; set; }
+
+        [Option('v', "verbose", DefaultValue = true, HelpText = "Prints all messages to standard output.")]
+        public bool Verbose { get; set; }
+
+        [Option("jsonLogDir", DefaultValue = ".", HelpText = "Json LogGenerator Log directory")]
+        public string JsonLogDir { get; set; }
+
+        [OptionArray('j', "json", DefaultValue = new string[] {})]
+        public string[] JsonLogFiles { get; set; }
+
+        [OptionArray("jroll", DefaultValue = new string[] { })]
+        public string[] JsonRollingLogFiles { get; set; }
+        
+        [Option("jsonRate", DefaultValue = 30, HelpText = "Json Rate in Milliseconds between generation of log lines")]
+        public int JsonRate { get; set; }
+
+        [Option('u', "udp", DefaultValue = 0, HelpText = "Enable UDP generator on this Port")]
+        public int Udp { get; set; }
+
+        [Option("udp-host", DefaultValue = "localhost", HelpText = "Host to send Udp data to")]
+        public string UdpHost { get; set; }
+
+        [Option("udp-rate", DefaultValue = 10, HelpText = "Udp Rate in Milliseconds between generation of log lines")]
+        public int UdpRate { get; set; }
+
+        [Option('t', "tcp", DefaultValue = 0, HelpText = "Enable Tcp generator on this Port")]
+        public int Tcp { get; set; }
+
+        [Option("tcp-host", DefaultValue = "localhost", HelpText = "Host to send Tcp data to")]
+        public string TcpHost { get; set; }
+
+        [Option("tcp-rate", DefaultValue = 10, HelpText = "Tcp Rate in Milliseconds between generation of log lines")]
+        public int TcpRate { get; set; }
+
+        [Option('r', "redis", DefaultValue = 0, HelpText = "Enable Redis generator on this Port")]
+        public int Redis { get; set; }
+
+        [Option("redis-host", DefaultValue = "", HelpText = "Host to send Redis data to")]
+        public string RedisHost { get; set; }
+
+        [ParserState]
+        public IParserState LastParserState { get; set; }
+
+        [HelpOption]
+        public string GetUsage()
+        {
+            return HelpText.AutoBuild(this,
+              (HelpText current) => HelpText.DefaultParsingErrorsHandler(this, current));
+        }
+    }
+}

TimberWinR.TestGenerator/JsonLogFileGenerator.cs

@@ -0,0 +1,252 @@
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Runtime.Remoting.Messaging;
+using System.Threading;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+using NLog;
+using NLog.Config;
+using NLog.Targets;
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using System.IO;
+
+namespace TimberWinR.TestGenerator
+{
+    class JsonLogFileTestParameters
+    {
+        public int NumMessages { get; set; }
+        public string LogFileDir { get; set; }
+        public string LogFileName { get; set; }
+        public int SleepTimeMilliseconds { get; set; }
+        public JsonLogFileTestParameters()
+        {
+            SleepTimeMilliseconds = 30;
+            LogFileDir = ".";
+            NumMessages = 10;
+        }
+    }
+
+    class JsonLogFileGenerator
+    {
+        public static int Generate(JsonLogFileTestParameters parms)
+        {
+            LogManager.GetCurrentClassLogger().Info("Start JSON LogFile Generation for: {0} on Thread: {1}", Path.GetFullPath(parms.LogFileName), Thread.CurrentThread.ManagedThreadId);
+
+            var logFilePath = Path.Combine(parms.LogFileDir, parms.LogFileName);
+
+            try
+            {
+                if (File.Exists(logFilePath))
+                {
+                    LogManager.GetCurrentClassLogger().Info("Deleting file: {0}", logFilePath);
+                    File.Delete(logFilePath);
+                }
+            }
+            catch (Exception ex)
+            {
+                LogManager.GetCurrentClassLogger().Error(ex);
+            }
+
+
+            var hostName = System.Environment.MachineName + "." +
+                   Microsoft.Win32.Registry.LocalMachine.OpenSubKey(
+                       "SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters").GetValue("Domain", "").ToString();
+
+            var watch = Stopwatch.StartNew();
+
+            // This text is always added, making the file longer over time 
+            // if it is not deleted. 
+            using (StreamWriter sw = File.AppendText(logFilePath))
+            {
+                sw.AutoFlush = true;
+                for (int i = 0; i < parms.NumMessages; i++)
+                {
+                    JObject o = new JObject
+                    {
+                        {"LineNumber", i+1},
+                        {"Application", "jsonlogfile-generator"},
+                        {"Host", hostName},
+                        {"UtcTimestamp", DateTime.UtcNow.ToString("o")},
+                        {"Type", "jsonlog"},
+                        {"Message", string.Format("{0}: Testgenerator jsonlogfile message {1}", i+1, DateTime.UtcNow.ToString("o"))},
+                        {"Index", "logstash"}
+                    };
+                    sw.WriteLine(o.ToString(Formatting.None));
+
+                    Thread.Sleep(parms.SleepTimeMilliseconds);
+                }
+                LogManager.GetCurrentClassLogger().Info("Elapsed Time for {0} was {1} seconds", Path.GetFullPath(parms.LogFileName), watch.Elapsed);
+                watch.Reset();
+            }
+
+            LogManager.GetCurrentClassLogger().Info("Finished JSON Log File Generation for: {0} elapsed: {1}", Path.GetFullPath(parms.LogFileName), watch.Elapsed);
+
+            return parms.NumMessages;
+        }
+    }
+
+    class JsonRollingLogFileGenerator
+    {
+        public static int Generate(JsonLogFileTestParameters parms)
+        {
+            LogManager.GetCurrentClassLogger().Info("Start JSON RollingLogFile Generation for: {0} on Thread: {1}", Path.GetFullPath(parms.LogFileName), Thread.CurrentThread.ManagedThreadId);
+
+            var logFilePath = Path.Combine(parms.LogFileDir, parms.LogFileName);
+
+            try
+            {
+                if (File.Exists(logFilePath))
+                    File.Delete(logFilePath);
+
+                if (File.Exists(logFilePath + ".rolled"))
+                    File.Delete(logFilePath + ".rolled");
+            }
+            catch (Exception ex)
+            {
+                LogManager.GetCurrentClassLogger().Error(ex);
+            }
+
+
+            var hostName = System.Environment.MachineName + "." +
+                   Microsoft.Win32.Registry.LocalMachine.OpenSubKey(
+                       "SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters").GetValue("Domain", "").ToString();
+
+         
+            int quarters = parms.NumMessages/4;
+
+            int[] segments = new int[] {quarters, quarters, quarters, quarters + parms.NumMessages%4};
+            var watch = Stopwatch.StartNew();
+
+
+            int recordNumber = 0;
+            int currentTotal = 0;
+            for (int segment = 0; segment < 4; segment++)
+            {
+                currentTotal += segments[segment];
+             
+                // This text is always added, making the file longer over time 
+                // if it is not deleted. 
+                using (StreamWriter sw = File.AppendText(logFilePath))
+                {
+                    sw.AutoFlush = true;
+   
+                    var lwatch = Stopwatch.StartNew();
+
+                    // The Rolling Generator will roll 1/2 way through the log             
+                    for (int i = 0; i < segments[segment]; i++)
+                    {
+                        JObject o = new JObject
+                        {
+                            {"LineNumber", recordNumber + 1},
+                            {"Application", "jsonrollinglogfile-generator"},
+                            {"Host", hostName},
+                            {"UtcTimestamp", DateTime.UtcNow.ToString("o")},
+                            {"Type", "jsonrollinglog"},
+                            {
+                                "Message",
+                                string.Format("{0}: Testgenerator jsonrollinglogfile message {1}", recordNumber + 1,
+                                    DateTime.UtcNow.ToString("o"))
+                            },
+                            {"Index", "logstash"}
+                        };
+                        sw.WriteLine(o.ToString(Formatting.None));
+                        recordNumber++;
+                        Thread.Sleep(parms.SleepTimeMilliseconds);
+                    }
+                    LogManager.GetCurrentClassLogger().Info("Elapsed Time for {0} was {1} seconds for {2} logs", Path.GetFullPath(parms.LogFileName), lwatch.Elapsed, segments[segment]);
+                   
+                }
+               
+                // 
+                // We might not have yet processed all the lines from the first file, so wait till
+                // we catch up before rolling the log file.
+                //
+                LogManager.GetCurrentClassLogger().Info("{0}: Waiting for output to catch up: {1} {2}", Thread.CurrentThread.ManagedThreadId, logFilePath, currentTotal);
+                WaitOutputToCatchUp(logFilePath, currentTotal);
+
+                //
+                // Roll the log + wait for the reader to catch up.
+                //  
+                
+                LogManager.GetCurrentClassLogger().Info("{0}: Rolling Log File: {1} {2}", Thread.CurrentThread.ManagedThreadId, logFilePath, File.GetCreationTimeUtc(logFilePath));
+
+                RollLogFile(logFilePath); 
+                
+                LogManager.GetCurrentClassLogger().Info("{0}: Finished Rolling Log File: {1}", Thread.CurrentThread.ManagedThreadId, logFilePath);           
+            }
+            
+            watch.Stop();
+           
+            LogManager.GetCurrentClassLogger().Info("Finished JSON RollingLogFile File Generation for: {0} elapsed: {1}", Path.GetFullPath(parms.LogFileName), watch.Elapsed);
+
+            return parms.NumMessages;
+        }
+
+        private static void WaitOutputToCatchUp(string logFilePath, int firstPart)
+        {
+            bool caughtUp = false;
+            do
+            {
+                var json = Program.Diagnostics.DiagnosticsOutput();
+
+                IList<JToken> inputs = json["timberwinr"]["inputs"].Children().ToList();
+                foreach (JToken t in inputs)
+                {
+                    JProperty inputProp = t.First as JProperty;
+                    if (inputProp.Name == "taillog" || inputProp.Name == "log")
+                    {
+                        var files = inputProp.Value["filedb"].Children().ToList();
+                        foreach (var file in files)
+                        {
+                            var fileName = file["FileName"].ToString();
+                            FileInfo fi1 = new FileInfo(fileName);
+                            FileInfo fi2 = new FileInfo(logFilePath);
+                            if (fi1.FullName == fi2.FullName)
+                            {
+                                var linesProcessed = file["LinesProcessed"].Value<int>();
+                                if (linesProcessed >= firstPart)
+                                {
+                                    caughtUp = true;
+                                    break;
+                                }
+                            }
+                        }
+                    }
+                }
+
+                Thread.Sleep(300);
+            } while (!caughtUp);
+
+            LogManager.GetCurrentClassLogger().Info("{0}:  Finished Waiting for output to catch up: {1} {2}", Thread.CurrentThread.ManagedThreadId, logFilePath, firstPart);            
+
+        }
+
+        private static void RollLogFile(string logFilePath)
+        {
+            bool moved = false;           
+            do
+            {
+                try
+                {
+                    if (File.Exists(logFilePath + ".rolled"))
+                        File.Delete(logFilePath + ".rolled");
+
+                    File.Move(logFilePath, logFilePath + ".rolled");
+                    moved = true;                   
+                }
+                catch (Exception)
+                {
+                    Thread.Sleep(100);
+                }
+            } while (!moved);
+            Thread.Sleep(1000);
+        }
+    }
+
+}

TimberWinR.TestGenerator/LogFileGenerator.cs

@@ -0,0 +1,94 @@
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Runtime.Remoting.Messaging;
+using System.Threading;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+using NLog;
+using NLog.Config;
+using NLog.Targets;
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using System.IO;
+
+
+namespace TimberWinR.TestGenerator
+{
+    class LogFileTestParameters
+    {
+        public int NumMessages { get; set; }
+        public string LogFileDir { get; set; }
+        public string LogFileName { get; set; }
+        public int SleepTimeMilliseconds { get; set; }
+        public LogFileTestParameters()
+        {
+            SleepTimeMilliseconds = 30;
+            LogFileDir = ".";
+            NumMessages = 10;
+        }
+    }
+
+    class LogFileGenerator
+    {
+        public static int Generate(JsonLogFileTestParameters parms)
+        {
+            LogManager.GetCurrentClassLogger().Info("Start LogFile Generation for: {0} on Thread: {1}", Path.GetFullPath(parms.LogFileName), Thread.CurrentThread.ManagedThreadId);
+
+            var logFilePath = Path.Combine(parms.LogFileDir, parms.LogFileName);
+
+            try
+            {
+                if (File.Exists(logFilePath))
+                {
+                    LogManager.GetCurrentClassLogger().Info("Deleting file: {0}", logFilePath);
+                    File.Delete(logFilePath);
+                }
+            }
+            catch (Exception ex)
+            {
+                LogManager.GetCurrentClassLogger().Error(ex);
+            }
+
+
+            var hostName = System.Environment.MachineName + "." +
+                   Microsoft.Win32.Registry.LocalMachine.OpenSubKey(
+                       "SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters").GetValue("Domain", "").ToString();
+
+            var watch = Stopwatch.StartNew();
+
+            // This text is always added, making the file longer over time 
+            // if it is not deleted. 
+            using (StreamWriter sw = File.AppendText(logFilePath))
+            {
+                sw.AutoFlush = true;
+                for (int i = 0; i < parms.NumMessages; i++)
+                {
+                    JObject o = new JObject
+                    {
+                        {"LineNumber", i+1},
+                        {"Application", "logfile-generator"},
+                        {"Host", hostName},
+                        {"UtcTimestamp", DateTime.UtcNow.ToString("o")},
+                        {"Type", "log"},
+                        {"Message", string.Format("{0}: Testgenerator logfile message {1}", i+1, DateTime.UtcNow.ToString("o"))},
+                        {"Index", "logstash"}
+                    };
+                    sw.WriteLine(o.ToString(Formatting.None));
+
+                    Thread.Sleep(parms.SleepTimeMilliseconds);
+                }
+                LogManager.GetCurrentClassLogger().Info("Elapsed Time for {0} was {1} seconds", Path.GetFullPath(parms.LogFileName), watch.Elapsed);
+                watch.Reset();
+            }
+
+            LogManager.GetCurrentClassLogger().Info("Finished LogFile Generation for: {0} elapsed: {1}", Path.GetFullPath(parms.LogFileName), watch.Elapsed);
+
+            return parms.NumMessages;
+        }
+    }
+}

TimberWinR.TestGenerator/Program.cs

@@ -0,0 +1,584 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Linq.Expressions;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using System.CodeDom.Compiler;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+
+using NLog;
+using NLog.Config;
+using NLog.Targets;
+using ServiceStack.Text.Jsv;
+using TimberWinR.Parser;
+
+
+namespace TimberWinR.TestGenerator
+{
+    public class Program
+    {
+        private static List<Task> _tasks = new List<Task>();
+        private static CancellationTokenSource _cancellationTokenSource = new CancellationTokenSource();
+        private static Manager _timberWinR;
+
+        public static Diagnostics.Diagnostics Diagnostics { get; set; }
+
+        private static PerformanceCounter cpuCounter = new PerformanceCounter();
+        private static PerformanceCounter ramCounter = new PerformanceCounter();
+        private static Task _monitorTask;
+
+        private static int _totalMessagesToSend;
+        private static int _cpuSampleCount;
+        private static double _avgCpuUsage;
+        private static double _totalCpuUsage;
+        private static double _maxCpuUsage;
+
+        private static int _memSampleCount;
+        private static double _avgMemUsage;
+        private static double _totalMemUsage;
+        private static double _maxMemUsage;
+
+        private static CommandLineOptions Options;
+
+        static int Main(string[] args)
+        {
+            _totalMessagesToSend = 0;
+
+            cpuCounter.CategoryName = "Processor";
+            cpuCounter.CounterName = "% Processor Time";
+            cpuCounter.InstanceName = "_Total";
+
+            ramCounter.CategoryName = "Memory";
+            ramCounter.CounterName = "% Committed Bytes In Use";
+           
+            Options = new CommandLineOptions();
+
+            if (CommandLine.Parser.Default.ParseArguments(args, Options))
+            {
+                var testFile = Options.TestFile;
+                if (!string.IsNullOrEmpty(testFile))
+                {
+                    if (!File.Exists(Options.TestFile))
+                        throw new Exception(string.Format("No such test file: {0} found", Options.TestFile));
+
+                    var fargs = ParseTestArguments(testFile, ref Options);
+                    if (!CommandLine.Parser.Default.ParseArguments(fargs, Options))
+                        return 2;
+                }
+
+                SetupTestDirectory(Options);
+
+                var swOverall = Stopwatch.StartNew();
+                swOverall.Start();
+
+                InitializeLogging(Options.LogLevel);
+
+                LogManager.GetCurrentClassLogger().Info("Starting CPU Usage: {0}, RAM Usage: {1}", getCurrentCpuUsage(), getAvailableRAM());
+
+                // Reset the tests.
+                ResetTests(Options);
+
+                var sw = Stopwatch.StartNew();
+
+                // Startup TimberWinR
+                StartTimberWinR(Options.TimberWinRConfigFile, Options.LogLevel, ".", false);
+
+                // Run the Generators
+                var arrayOfTasks = RunGenerators(Options);
+
+                // Wait for all Generators to finish
+                try
+                {
+                    Task.WaitAll(arrayOfTasks);
+                }
+                catch (AggregateException aex)
+                {
+                    LogManager.GetCurrentClassLogger().Error(aex);
+                }
+
+
+                LogManager.GetCurrentClassLogger().Info("Generation Finished: " + sw.Elapsed);
+                sw.Reset();
+                sw.Start();
+
+                // All generators are finished, wait till senders are done.
+                WaitForOutputTransmission();
+
+                LogManager.GetCurrentClassLogger().Info("Finished Transmission: " + sw.Elapsed);
+                sw.Reset();
+                sw.Start();
+
+                // Get all the stats
+                var jsonTimberWinr = ShutdownTimberWinR();
+
+                LogManager.GetCurrentClassLogger().Info("Finished Shutdown: " + sw.Elapsed);
+                sw.Stop();
+
+                swOverall.Stop();
+                LogManager.GetCurrentClassLogger().Info("Total Elapsed Time: {0}", swOverall.Elapsed);
+
+                int results = VerifyResults(Options, jsonTimberWinr);
+
+                Console.ReadKey();
+                return results;
+            }
+
+            return 1;
+        }
+
+        private static void CopySourceFile(string fileName, string outputDir)
+        {
+            FileInfo fi = new FileInfo(fileName);
+            if (fi.Exists)
+                File.Copy(fileName, Path.Combine(outputDir, fi.Name));
+        }
+
+        private static void SetupTestDirectory(CommandLineOptions options)
+        {
+            if (options.TestDir != "." && Directory.Exists(options.TestDir))
+                Directory.Delete(options.TestDir, true);
+
+            if (!Directory.Exists(options.TestDir))
+                Directory.CreateDirectory(options.TestDir);
+
+            CopySourceFile(options.TestFile, options.TestDir);
+            CopySourceFile(options.TimberWinRConfigFile, options.TestDir);
+            CopySourceFile(options.ExpectedResultsFile, options.TestDir);
+
+            Directory.SetCurrentDirectory(options.TestDir);
+        }
+
+        private static string[] ParseTestArguments(string testFile, ref CommandLineOptions options)
+        {
+            options = new CommandLineOptions();
+            JObject jtest = JObject.Parse(File.ReadAllText(testFile));
+            IList<JToken> inputs = jtest["arguments"].Children().ToList();
+            List<string> testargs = new List<string>();
+            foreach (JProperty it in inputs)
+            {
+                testargs.Add(it.Name);
+
+                var cc = it.Value.Children().Count();
+                if (cc > 0)
+                {
+                    for (int i = 0; i < cc; i++)
+                    {
+                        testargs.Add(it.Value[i].ToString());
+                    }
+                }
+                else
+                {
+                    testargs.Add(it.Value.ToString());
+                }
+            }
+            var fargs = testargs.ToArray();
+            return fargs;
+        }
+
+        private static int VerifyResults(CommandLineOptions options, JObject json)
+        {
+            var jresult = JObject.Parse(File.ReadAllText(options.ExpectedResultsFile));
+
+            json["maxCpuUsage"] = _maxCpuUsage;
+            json["avgCpuUsage"] = _avgCpuUsage;
+
+            json["maxMemUsage"] = _maxMemUsage;
+            json["avgMemUsage"] = _avgMemUsage;
+
+            // TailLogs
+
+            IList<JToken> inputs = json["timberwinr"]["inputs"].Children().ToList();
+            foreach (JToken t in inputs)
+            {
+                JProperty inputProp = t.First as JProperty;
+                switch (inputProp.Name)
+                {
+                    case "udp":
+                        if (VerifyConditions(json, new string[] {"udp"}, inputProp, jresult) != 0)
+                            return 1;
+                        break;
+                    case "tcp":
+                        if (VerifyConditions(json, new string[] {"tcp"}, inputProp, jresult) != 0)
+                            return 1;
+                        break;
+                    case "log":
+                    case "taillog":
+                        if (VerifyConditions(json, new string[] {"log", "taillog"}, inputProp, jresult) != 0)
+                            return 1;
+                        break;
+                }
+            }
+
+            return 0;
+        }
+
+        private static int VerifyConditions(JObject json, string[] logTypes, JProperty inputProp, JObject jresult)
+        {
+            var ttail = inputProp.Value as JObject;
+            foreach (var resultInput in jresult["Results"]["Inputs"].Children().ToList())
+            {
+                JProperty rinputProp = resultInput.First as JProperty;
+                if (logTypes.Contains(rinputProp.Name))
+                {
+                    foreach (JProperty testProp in rinputProp.Value)
+                    {
+                        try
+                        {
+                            var cond1 = testProp.Value.ToString();
+                            IList<string> tkeys = ttail.Properties().Select(pn => pn.Name).ToList();
+                            foreach (string tkey in tkeys)
+                                cond1 = cond1.Replace(string.Format("[{0}]", tkey), string.Format("{0}", ttail[tkey].ToString()));
+
+                            // Add builtins
+                            cond1 = cond1.Replace("[avgCpuUsage]", json["avgCpuUsage"].ToString());
+                            cond1 = cond1.Replace("[maxCpuUsage]", json["maxCpuUsage"].ToString());
+                            cond1 = cond1.Replace("[avgMemUsage]", json["avgMemUsage"].ToString());
+                            cond1 = cond1.Replace("[maxMemUsage]", json["maxMemUsage"].ToString());
+
+                            var p1 = Expression.Parameter(typeof(JObject), "json");
+                            var e1 = System.Linq.Dynamic.DynamicExpression.ParseLambda(new[] { p1 },
+                                typeof(bool), cond1);
+                            bool r1 = (bool)e1.Compile().DynamicInvoke(ttail);
+                            if (!r1)
+                            {
+                                LogManager.GetCurrentClassLogger().Error("Test Failed: '{0}: ({1})'", testProp.Name, cond1);
+                                return 1;
+
+                            }
+                            else
+                            {
+                                LogManager.GetCurrentClassLogger()
+                                    .Info("PASSED({0}): '{1}: ({2})'", inputProp.Name, testProp.Name, cond1);
+                            }
+                        }
+                        catch (Exception ex)
+                        {
+                            LogManager.GetCurrentClassLogger()
+                                .Error("Error parsing expression '{0}': {1}", testProp.Value.ToString(),
+                                    ex.Message);
+                            return 2;
+                        }
+                    }
+                }
+            }
+            return 0;
+        }
+
+        // Wait till all output has been transmitted.
+        private static void WaitForOutputTransmission()
+        {
+            bool completed = false;
+            do
+            {
+                var json = Diagnostics.DiagnosticsOutput();
+
+                //Console.WriteLine(json.ToString(Formatting.Indented));
+
+                IList<JToken> inputs = json["timberwinr"]["inputs"].Children().ToList();
+                foreach (var so in inputs.Children())
+                {
+                    var token = so.First;
+                    var messages = token["messages"].Value<int>();
+                    //  Console.WriteLine("{0} messages", messages);
+                }
+
+
+                IList<JToken> outputs = json["timberwinr"]["outputs"].Children().ToList();
+                foreach (var so in outputs.Children())
+                {
+                    var outputToken = so.First;
+
+                    var mbc = outputToken["queuedMessageCount"].Value<int>();
+                    var smc = outputToken["sentMessageCount"].Value<int>();
+
+                    // LogManager.GetCurrentClassLogger().Info("Queued: {0}, Sent: {1}", mbc, smc);
+
+                    completed = mbc == 0 && smc >= _totalMessagesToSend;
+                }
+                Thread.Sleep(250);
+            } while (!completed);
+        }
+
+        private static void sampleUsages()
+        {
+            getCurrentCpuUsage();
+            getAvailableRAM();
+        }
+
+        private static string getCurrentCpuUsage()
+        {
+            _cpuSampleCount++;
+            var v = cpuCounter.NextValue();
+            if (v > _maxCpuUsage)
+                _maxCpuUsage = v;
+
+            _totalCpuUsage += v;
+            _avgCpuUsage = _totalCpuUsage / _cpuSampleCount;
+
+            return v + "%";
+        }
+
+        private static string getAvailableRAM()
+        {
+            _memSampleCount++;
+            var v = ramCounter.NextValue();
+            if (v > _maxMemUsage)
+                _maxMemUsage = v;
+
+            _totalMemUsage += v;
+            _avgMemUsage = _totalMemUsage / _memSampleCount;
+            return v + "MB";
+        }
+
+        private static JObject ShutdownTimberWinR()
+        {
+            _timberWinR.Shutdown();
+
+            // Cancel any/all other threads
+            _cancellationTokenSource.Cancel();
+
+            var json = Diagnostics.DiagnosticsOutput();
+
+            LogManager.GetCurrentClassLogger()
+                .Info("Average CPU Usage: {0}%, Average RAM Usage: {1}MB, Max CPU: {2}%, Max Mem: {3}MB", _avgCpuUsage, _avgMemUsage, _maxCpuUsage, _maxMemUsage);
+
+            LogManager.GetCurrentClassLogger().Info(json.ToString());
+
+            Diagnostics.Shutdown();
+
+            return json;
+        }
+
+        static void StartTimberWinR(string configFile, string logLevel, string logFileDir, bool enableLiveMonitor)
+        {
+            _timberWinR = new TimberWinR.Manager(configFile, logLevel, logFileDir, enableLiveMonitor, _cancellationTokenSource.Token, false);
+            _timberWinR.OnConfigurationProcessed += TimberWinROnOnConfigurationProcessed;
+            _timberWinR.Start(_cancellationTokenSource.Token);
+            Diagnostics = new Diagnostics.Diagnostics(_timberWinR, _cancellationTokenSource.Token, 5141);
+        }
+
+        private static void TimberWinROnOnConfigurationProcessed(Configuration configuration)
+        {         
+            if (!string.IsNullOrEmpty(Options.RedisHost) && configuration.RedisOutputs != null && configuration.RedisOutputs.Count() > 0)
+            {
+                foreach (var ro in configuration.RedisOutputs)
+                {
+                    ro.Host = new string[] { Options.RedisHost };
+                }
+            }
+
+        }
+
+        static void InitializeLogging(string logLevel)
+        {
+            var loggingConfiguration = new LoggingConfiguration();
+
+            // Create our default targets
+            var coloredConsoleTarget = new ColoredConsoleTarget();
+
+            var logFileDir = ".";
+
+            Target fileTarget = CreateDefaultFileTarget(logFileDir);
+
+            loggingConfiguration.AddTarget("Console", coloredConsoleTarget);
+            loggingConfiguration.AddTarget("DailyFile", fileTarget);
+
+            // The LogLevel.Trace means has to be at least Trace to show up on console
+            loggingConfiguration.LoggingRules.Add(new LoggingRule("*", LogLevel.Trace, coloredConsoleTarget));
+            // LogLevel.Debug means has to be at least Debug to show up in logfile
+            loggingConfiguration.LoggingRules.Add(new LoggingRule("*", LogLevel.Debug, fileTarget));
+
+            LogManager.Configuration = loggingConfiguration;
+            LogManager.EnableLogging();
+
+            LogManager.GlobalThreshold = LogLevel.FromString(logLevel);
+        }
+
+        static FileTarget CreateDefaultFileTarget(string logPath)
+        {
+            return new FileTarget
+            {
+                ArchiveEvery = FileArchivePeriod.None,
+                ArchiveAboveSize = 5 * 1024 * 1024,
+                MaxArchiveFiles = 5,
+                BufferSize = 10,
+                FileName = Path.Combine(logPath, "TimberWinR.TestGenerator", "TimberWinRTestGen.log"),
+                ArchiveFileName = Path.Combine(logPath, "TimberWinR-TestGenerator_log-{#######}.log"),
+            };
+        }
+
+        static void ResetTests(CommandLineOptions options)
+        {
+            if (File.Exists(".timberwinrdb"))
+                File.Delete(".timberwinrdb");
+
+            if (File.Exists("TimberWinR.TestGenerator\\TimberWinRTestGen.log"))
+                File.Delete("TimberWinR.TestGenerator\\TimberWinRTestGen.log");
+
+            if (File.Exists("TimberWinR\\TimberWinR.log"))
+                File.Delete("TimberWinR\\TimberWinR.log");
+
+            if (options.JsonLogFiles.Length > 0)
+            {
+                foreach (var logFile in options.JsonLogFiles)
+                {
+                    if (File.Exists(logFile))
+                        File.Delete(logFile);
+                }
+            }
+
+            if (options.JsonRollingLogFiles.Length > 0)
+            {
+                foreach (var logFile in options.JsonRollingLogFiles)
+                {
+                    if (File.Exists(logFile))
+                        File.Delete(logFile);
+                }
+            }
+        }
+
+        static Task[] RunGenerators(CommandLineOptions options)
+        {
+            _monitorTask = Task.Factory.StartNew(() =>
+                {
+                    using (var syncHandle = new ManualResetEventSlim())
+                    {
+                        try
+                        {
+                            // Execute the query
+                            while (!_cancellationTokenSource.Token.IsCancellationRequested)
+                            {
+                                sampleUsages();
+                                // LogManager.GetCurrentClassLogger().Info("Starting CPU Usage: {0}, RAM Usage: {1}", getCurrentCpuUsage(), getAvailableRAM());
+                                syncHandle.Wait(TimeSpan.FromMilliseconds(options.JsonRate), _cancellationTokenSource.Token);
+                            }
+                        }
+                        catch (OperationCanceledException)
+                        {
+                        }
+                        catch (Exception ex)
+                        {
+                            LogManager.GetCurrentClassLogger().Error(ex);
+                        }
+                    }
+                }, _cancellationTokenSource.Token, TaskCreationOptions.LongRunning, TaskScheduler.Current);
+
+            StartJson(options);
+            StartJsonRolling(options);
+            StartUdp(options);
+            StartTcp(options);
+
+            return _tasks.ToArray();
+        }
+
+        static void StartJson(CommandLineOptions options)
+        {
+            if (options.JsonLogFiles.Length > 0)
+            {
+                foreach (var logFile in options.JsonLogFiles)
+                {
+                    _totalMessagesToSend += options.NumMessages;
+
+                    if (options.Verbose)
+                        LogManager.GetCurrentClassLogger()
+                            .Info("Starting LogFile Generator for {0}",
+                                Path.GetFullPath(Path.Combine(options.JsonLogDir, logFile)));
+                    _tasks.Add(Task.Factory.StartNew(() =>
+                    {
+                        var p = new JsonLogFileTestParameters()
+                        {
+                            NumMessages = options.NumMessages,
+                            LogFileDir = options.JsonLogDir,
+                            LogFileName = logFile,
+                            SleepTimeMilliseconds = options.JsonRate
+                        };
+                        JsonLogFileGenerator.Generate(p);
+                        Thread.Sleep(250);
+                    }));
+
+                }
+            }
+        }
+
+        private static void StartJsonRolling(CommandLineOptions options)
+        {
+            if (options.JsonRollingLogFiles.Length > 0)
+            {
+                foreach (var logFile in options.JsonRollingLogFiles)
+                {
+                    _totalMessagesToSend += options.NumMessages;
+
+                    if (options.Verbose)
+                        LogManager.GetCurrentClassLogger()
+                            .Info("Starting RollingLogFile Generator for {0}",
+                                Path.GetFullPath(Path.Combine(options.JsonLogDir, logFile)));
+                    _tasks.Add(Task.Factory.StartNew(() =>
+                    {
+                        var p = new JsonLogFileTestParameters()
+                        {
+                            NumMessages = options.NumMessages,
+                            LogFileDir = options.JsonLogDir,
+                            LogFileName = logFile,
+                            SleepTimeMilliseconds = options.JsonRate
+                        };
+                        JsonRollingLogFileGenerator.Generate(p);
+                        Thread.Sleep(250);
+                    }));
+
+                }
+            }
+        }
+
+        static void StartUdp(CommandLineOptions options)
+        {
+            if (options.Udp > 0)
+            {
+                if (options.Verbose)
+                    LogManager.GetCurrentClassLogger()
+                        .Info("Starting UDP Generator for {0}:{1}", options.UdpHost, options.Udp);
+
+                _tasks.Add(Task.Factory.StartNew(() =>
+                {
+                    var p = new UdpTestParameters()
+                    {
+                        Port = options.Udp,
+                        Host = options.UdpHost,
+                        NumMessages = options.NumMessages,
+                        SleepTimeMilliseconds = options.UdpRate
+                    };
+                    _totalMessagesToSend += UdpTestGenerator.Generate(p);
+                }));
+            }
+        }
+
+        static void StartTcp(CommandLineOptions options)
+        {
+            if (options.Tcp > 0)
+            {
+                if (options.Verbose)
+                    LogManager.GetCurrentClassLogger()
+                        .Info("Starting Tcp Generator for {0}:{1}", options.TcpHost, options.Tcp);
+
+                _totalMessagesToSend += options.NumMessages;
+
+                _tasks.Add(Task.Factory.StartNew(() =>
+                {
+                    var p = new TcpTestParameters()
+                    {
+                        Port = options.Tcp,
+                        Host = options.TcpHost,
+                        NumMessages = options.NumMessages,
+                        SleepTimeMilliseconds = options.TcpRate
+                    };
+                    TcpTestGenerator.Generate(p);
+                }));
+            }
+        }
+
+    }
+}

TimberWinR.TestGenerator/Properties/AssemblyInfo.cs

@@ -0,0 +1,36 @@
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+// General Information about an assembly is controlled through the following 
+// set of attributes. Change these attribute values to modify the information
+// associated with an assembly.
+[assembly: AssemblyTitle("TimberWinR.TestGenerator")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyProduct("TimberWinR.TestGenerator")]
+[assembly: AssemblyCopyright("Copyright ©  2015")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCulture("")]
+
+// Setting ComVisible to false makes the types in this assembly not visible 
+// to COM components.  If you need to access a type in this assembly from 
+// COM, set the ComVisible attribute to true on that type.
+[assembly: ComVisible(false)]
+
+// The following GUID is for the ID of the typelib if this project is exposed to COM
+[assembly: Guid("a56bf91c-c5f8-4771-8ef8-ab9ad28179c4")]
+
+// Version information for an assembly consists of the following four values:
+//
+//      Major Version
+//      Minor Version 
+//      Build Number
+//      Revision
+//
+// You can specify all the values or you can default the Build and Revision Numbers 
+// by using the '*' as shown below:
+// [assembly: AssemblyVersion("1.0.*")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]

TimberWinR.TestGenerator/RedisTestGenerator.cs

@@ -0,0 +1,49 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Newtonsoft.Json.Linq;
+using ServiceStack.Redis;
+
+namespace TimberWinR.TestGenerator
+{
+    class RedisTestParameters
+    {
+        public int Port { get; set; }
+        public string Host { get; set; }
+        public int NumMessages { get; set; }
+        public RedisTestParameters()
+        {
+            NumMessages = 100;
+            Port = 6379;
+            Host = "localhost";
+        }
+    }
+
+    class RedisTestGenerator
+    {
+        public static void Generate(RedisTestParameters parms)
+        {
+            var hostName = System.Environment.MachineName + "." +
+               Microsoft.Win32.Registry.LocalMachine.OpenSubKey(
+                   "SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters").GetValue("Domain", "").ToString();
+
+            var rc = new RedisClient(parms.Host, parms.Port);
+
+            for (int i = 0; i < parms.NumMessages; i++)
+            {
+                JObject o = new JObject
+                {
+                    {"Application", "redis-generator"},               
+                    {"Host", hostName},
+                    {"UtcTimestamp", DateTime.UtcNow.ToString("o")},
+                    {"Type", "redis"},                
+                    {"Message", "redis message " + DateTime.UtcNow.ToString("o")},
+                    {"Index", "logstash"}
+                };
+                byte[] bytes = System.Text.Encoding.UTF8.GetBytes(o.ToString());
+                var restult = rc.RPush("logstash", bytes);
+            }
+        }
+    }
+}

TimberWinR.TestGenerator/TcpTestGenerator.cs

@@ -0,0 +1,62 @@
+using System.Threading;
+using Newtonsoft.Json.Linq;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using ServiceStack.Text;
+
+namespace TimberWinR.TestGenerator
+{
+    class TcpTestParameters
+    {
+        public int Port { get; set; }
+        public string Host { get; set; }
+        public int NumMessages { get; set; }
+        public int SleepTimeMilliseconds { get; set; }
+        public TcpTestParameters()
+        {
+            NumMessages = 100;
+            Port = 5140;
+            Host = "localhost";
+            SleepTimeMilliseconds = 10;
+        }
+    }
+
+    class TcpTestGenerator
+    {
+        public static int Generate(TcpTestParameters parms)
+        {
+            TcpClient server = new TcpClient(parms.Host, parms.Port);
+            
+            var hostName = System.Environment.MachineName + "." +
+                       Microsoft.Win32.Registry.LocalMachine.OpenSubKey(
+                           "SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters").GetValue("Domain", "").ToString();
+
+
+            using (NetworkStream stream = server.GetStream())
+            {              
+                for (int i = 0; i < parms.NumMessages; i++)
+                {
+                    JObject o = new JObject
+                    {
+                        {"Application", "tcp-generator"},
+                        {"Host", hostName},
+                        {"UtcTimestamp", DateTime.UtcNow.ToString("o")},
+                        {"Type", "tcp"},
+                        {"Message", "tcp message " + DateTime.UtcNow.ToString("o")},
+                        {"Index", "logstash"}
+                    };
+                    byte[] data = Encoding.UTF8.GetBytes(string.Format("{0}\n", o.ToString()));
+                    stream.Write(data, 0, data.Length);
+                    Thread.Sleep(parms.SleepTimeMilliseconds);
+                }
+            }
+
+            return parms.NumMessages;
+        }
+
+    }
+}

TimberWinR.TestGenerator/TimberWinR.TestGenerator.csproj

@@ -0,0 +1,133 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="12.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}</ProjectGuid>
+    <OutputType>Exe</OutputType>
+    <AppDesignerFolder>Properties</AppDesignerFolder>
+    <RootNamespace>TimberWinR.TestGenerator</RootNamespace>
+    <AssemblyName>TimberWinR.TestGenerator</AssemblyName>
+    <TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
+    <FileAlignment>512</FileAlignment>
+    <SolutionDir Condition="$(SolutionDir) == '' Or $(SolutionDir) == '*Undefined*'">..\</SolutionDir>
+    <RestorePackages>true</RestorePackages>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="CommandLine">
+      <HintPath>..\packages\CommandLineParser.1.9.71\lib\net40\CommandLine.dll</HintPath>
+    </Reference>
+    <Reference Include="Newtonsoft.Json, Version=6.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Newtonsoft.Json.6.0.8\lib\net40\Newtonsoft.Json.dll</HintPath>
+    </Reference>
+    <Reference Include="NLog, Version=3.2.0.0, Culture=neutral, PublicKeyToken=5120e14c03d0593c, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\NLog.3.2.0.0\lib\net40\NLog.dll</HintPath>
+    </Reference>
+    <Reference Include="ServiceStack.Common">
+      <HintPath>..\packages\ServiceStack.Common.Signed.4.0.38\lib\net40\ServiceStack.Common.dll</HintPath>
+    </Reference>
+    <Reference Include="ServiceStack.Interfaces">
+      <HintPath>..\packages\ServiceStack.Interfaces.4.0.38\lib\portable-wp80+sl5+net40+win8+monotouch+monoandroid\ServiceStack.Interfaces.dll</HintPath>
+    </Reference>
+    <Reference Include="ServiceStack.Redis">
+      <HintPath>..\packages\ServiceStack.Redis.Signed.4.0.38\lib\net40\ServiceStack.Redis.dll</HintPath>
+    </Reference>
+    <Reference Include="ServiceStack.Text">
+      <HintPath>..\packages\ServiceStack.Text.Signed.4.0.38\lib\net40\ServiceStack.Text.dll</HintPath>
+    </Reference>
+    <Reference Include="System" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Xml.Linq" />
+    <Reference Include="System.Data.DataSetExtensions" />
+    <Reference Include="Microsoft.CSharp" />
+    <Reference Include="System.Data" />
+    <Reference Include="System.Xml" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="CommandLineOptions.cs" />
+    <Compile Include="Dynamic.cs" />
+    <Compile Include="LogFileGenerator.cs" />
+    <Compile Include="Program.cs" />
+    <Compile Include="Properties\AssemblyInfo.cs" />
+    <Compile Include="RedisTestGenerator.cs" />
+    <Compile Include="TcpTestGenerator.cs" />
+    <Compile Include="JsonLogFileGenerator.cs" />
+    <Compile Include="UdpTestGenerator.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <Content Include="default.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <Content Include="results1.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <Content Include="test1.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <Content Include="test1-twconfig.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <None Include="packages.config" />
+    <Content Include="test2-tw.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <Content Include="test2.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <Content Include="results2.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <Content Include="test3.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <Content Include="test3-tw.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <Content Include="results3.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\TimberWinR\TimberWinR.csproj">
+      <Project>{4ef96a08-21db-4178-be44-70dae594632c}</Project>
+      <Name>TimberWinR</Name>
+    </ProjectReference>
+  </ItemGroup>
+  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <Import Project="$(SolutionDir)\.nuget\NuGet.targets" Condition="Exists('$(SolutionDir)\.nuget\NuGet.targets')" />
+  <Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
+    <PropertyGroup>
+      <ErrorText>This project references NuGet package(s) that are missing on this computer. Enable NuGet Package Restore to download them.  For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
+    </PropertyGroup>
+    <Error Condition="!Exists('$(SolutionDir)\.nuget\NuGet.targets')" Text="$([System.String]::Format('$(ErrorText)', '$(SolutionDir)\.nuget\NuGet.targets'))" />
+  </Target>
+  <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
+       Other similar extension points exist, see Microsoft.Common.targets.
+  <Target Name="BeforeBuild">
+  </Target>
+  <Target Name="AfterBuild">
+  </Target>
+  -->
+</Project>

TimberWinR.TestGenerator/UdpTestGenerator.cs

@@ -0,0 +1,70 @@
+using System.Threading;
+using Newtonsoft.Json.Linq;
+using NLog;
+using NLog.Config;
+using NLog.Targets;
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+
+namespace TimberWinR.TestGenerator
+{
+    class UdpTestParameters
+    {
+        public int Port { get; set; }
+        public string Host { get; set; }
+        public int NumMessages { get; set; }
+        public int SleepTimeMilliseconds { get; set; }
+        public UdpTestParameters()
+        {
+            NumMessages = 100;
+            Port = 6379;
+            Host = "localhost";
+            SleepTimeMilliseconds = 10;
+        }
+    }
+
+    class UdpTestGenerator
+    {
+        public static int Generate(UdpTestParameters parms)
+        {
+            var hostName = System.Environment.MachineName + "." +
+               Microsoft.Win32.Registry.LocalMachine.OpenSubKey(
+                   "SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters").GetValue("Domain", "").ToString();
+     
+            IPAddress broadcast;
+            if (!IPAddress.TryParse(parms.Host, out broadcast))
+                broadcast = Dns.GetHostEntry(parms.Host).AddressList[0];
+
+            Socket s = new Socket(broadcast.AddressFamily, SocketType.Dgram, ProtocolType.Udp);
+
+            LogManager.GetCurrentClassLogger().Info("Start UDP Generation");
+
+            for (int i = 0; i < parms.NumMessages; i++)
+            {
+                JObject o = new JObject
+                {
+                    {"Application", "udp-generator"},               
+                    {"Host", hostName},
+                    {"UtcTimestamp", DateTime.UtcNow.ToString("o")},
+                    {"Type", "udp"},                
+                    {"Message", "Testgenerator udp message " + DateTime.UtcNow.ToString("o")},
+                    {"Index", "logstash"}
+                };
+                byte[] sendbuf = Encoding.UTF8.GetBytes(o.ToString());
+                IPEndPoint ep = new IPEndPoint(broadcast, parms.Port);
+                s.SendTo(sendbuf, ep);
+                Thread.Sleep(parms.SleepTimeMilliseconds);
+            }
+
+            LogManager.GetCurrentClassLogger().Info("Finished UDP Generation");
+
+            return parms.NumMessages;
+        }
+
+    }
+}

TimberWinR.TestGenerator/default.json

@@ -0,0 +1,45 @@
+{
+    "TimberWinR": {
+        "Inputs": {           
+            "Udp": [
+                {
+                    "_comment": "Output from NLog",
+                    "port": 5140
+                }
+            ],
+             "TailFiles": [
+                {  
+                    "interval": 5,
+                    "logSource": "log files",
+                    "location": "*.jlog",
+                    "recurse": -1
+                }
+            ]
+        },
+        "Filters": [
+            {
+                "grok": {
+                    "condition": "\"[EventTypeName]\" == \"Information Event\"",
+                    "match": [
+                        "Text",
+                        ""
+                    ],
+                    "drop": "true"
+                }
+            }
+        ],
+        "Outputs": {
+            "Redis": [
+                {
+                    "_comment": "Change the host to your Redis instance",
+                    "port": 6379,
+                    "batch_count": 500,
+                    "threads":  2,
+                    "host": [
+                        "tstlexiceapp006.vistaprint.svc"
+                    ]
+                }
+            ]
+        }
+    }
+}

TimberWinR.TestGenerator/packages.config

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="CommandLineParser" version="1.9.71" targetFramework="net40" />
+  <package id="Newtonsoft.Json" version="6.0.8" targetFramework="net40" />
+  <package id="NLog" version="3.2.0.0" targetFramework="net40" />
+  <package id="ServiceStack.Common.Signed" version="4.0.38" targetFramework="net40" />
+  <package id="ServiceStack.Interfaces" version="4.0.38" targetFramework="net40" />
+  <package id="ServiceStack.Redis.Signed" version="4.0.38" targetFramework="net40" />
+  <package id="ServiceStack.Text.Signed" version="4.0.38" targetFramework="net40" />
+</packages>

TimberWinR.TestGenerator/results1.json

@@ -0,0 +1,20 @@
+{
+    "Results": {
+        "Inputs": [
+            {
+                "taillog": {
+                    "test1: message sent count": "[messages] == 7404",
+                    "test2: average cpu": "[avgCpuUsage] <= 30",
+                    "test3: maximum memory": "[maxMemUsage] <= 20"                
+                }
+            },
+            {
+                "udp": {
+                    "test1: message sent count": "[messages] == 1234",
+                    "test2: average cpu": "[avgCpuUsage] <= 30",
+                    "test3: maximum memory": "[maxMemUsage] <= 20"              
+                }
+            }
+        ]
+    }
+}

TimberWinR.TestGenerator/results2.json

@@ -0,0 +1,20 @@
+{
+    "Results": {
+        "Inputs": [
+            {
+                "taillog": {
+                    "test1: message sent count": "[messages] == 7404",
+                    "test2: average cpu": "[avgCpuUsage] <= 30",
+                    "test3: maximum memory": "[maxMemUsage] <= 15"
+                }
+            },
+            {
+                "udp": {
+                    "test1: message sent count": "[messages] == 1234",
+                    "test2: average cpu": "[avgCpuUsage] <= 30",
+                    "test3: maximum memory": "[maxMemUsage] <= 15"
+                }
+            }
+        ]
+    }
+}

TimberWinR.TestGenerator/results3.json

@@ -0,0 +1,20 @@
+{
+    "Results": {
+        "Inputs": [
+            {
+                "taillog": {
+                    "test1: message sent count": "[messages] == 7404",
+                    "test2: average cpu": "[avgCpuUsage] <= 30",
+                    "test3: maximum memory": "[maxMemUsage] <= 15"
+                }
+            },
+            {
+                "tcp": {
+                    "test4: message sent count": "[messages] == 1234",
+                    "test5: average cpu": "[avgCpuUsage] <= 30",
+                    "test6: maximum memory": "[maxMemUsage] <= 15"
+                }
+            }
+        ]
+    }
+}

TimberWinR.TestGenerator/test1-twconfig.json

@@ -0,0 +1,45 @@
+{
+    "TimberWinR": {
+        "Inputs": {           
+            "Udp": [
+                {
+                    "_comment": "Output from NLog",
+                    "port": 5140
+                }
+            ],
+             "TailFiles": [
+                {  
+                    "interval": 5,
+                    "logSource": "log files",
+                    "location": "*.jlog",
+                    "recurse": -1
+                }
+            ]
+        },
+        "Filters": [
+            {
+                "grok": {
+                    "condition": "\"[EventTypeName]\" == \"Information Event\"",
+                    "match": [
+                        "Text",
+                        ""
+                    ],
+                    "drop": "true"
+                }
+            }
+        ],
+        "Outputs": {
+            "Redis": [
+                {
+                    "_comment": "Change the host to your Redis instance",
+                    "port": 6379,
+                    "batch_count": 500,
+                    "threads":  2,
+                    "host": [
+                        "tstlexiceapp006.vistaprint.svc"
+                    ]
+                }
+            ]
+        }
+    }
+}

TimberWinR.TestGenerator/test1.json

@@ -0,0 +1,15 @@
+{
+    "test": "Test 1",
+    "arguments": {
+        "--testFile": "test1.json",
+        "--testDir": "test1",
+        "--timberWinRConfig": "test1-twconfig.json",
+        "--numMessages": 1234,
+        "--logLevel": "debug",
+        "--udp-host":  "::1",
+        "--udp": "5140",
+        "--jroll": ["r1.jlog", "r2.jlog"],
+        "--json": ["1.jlog", "2.jlog", "3.jlog", "4.jlog"],
+        "--resultsFile": "results1.json"
+    }
+}

TimberWinR.TestGenerator/test2-tw.json

@@ -0,0 +1,45 @@
+{
+    "TimberWinR": {
+        "Inputs": {           
+            "Udp": [
+                {
+                    "_comment": "Output from NLog",
+                    "port": 5140
+                }
+            ],
+             "Logs": [
+                {  
+                    "interval": 5,
+                    "logSource": "log files",
+                    "location": "*.jlog",
+                    "recurse": -1
+                }
+            ]
+        },
+        "Filters": [
+            {
+                "grok": {
+                    "condition": "\"[EventTypeName]\" == \"Information Event\"",
+                    "match": [
+                        "Text",
+                        ""
+                    ],
+                    "drop": "true"
+                }
+            }
+        ],
+        "Outputs": {
+            "Redis": [
+                {
+                    "_comment": "Change the host to your Redis instance",
+                    "port": 6379,
+                    "batch_count": 500,
+                    "threads":  2,
+                    "host": [
+                        "tstlexiceapp006.vistaprint.svc"
+                    ]
+                }
+            ]
+        }
+    }
+}

TimberWinR.TestGenerator/test2.json

@@ -0,0 +1,14 @@
+{
+    "test": "Test 2",
+    "arguments": {
+        "--testFile": "test2.json",
+        "--testDir": "test2",
+        "--timberWinRConfig": "test2-tw.json",
+        "--numMessages": 1234,
+        "--logLevel": "debug",
+        "--udp": "5140",
+        "--jroll": ["r1.jlog", "r2.jlog"],
+        "--json": ["1.jlog", "2.jlog", "3.jlog", "4.jlog"],
+        "--resultsFile": "results2.json"
+    }
+}

TimberWinR.TestGenerator/test3-tw.json

@@ -0,0 +1,45 @@
+{
+    "TimberWinR": {
+        "Inputs": {           
+            "Tcp": [
+                {
+                    "_comment": "Output from NLog",
+                    "port": 5140
+                }
+            ],
+             "Logs": [
+                {  
+                    "interval": 5,
+                    "logSource": "log files",
+                    "location": "*.jlog",
+                    "recurse": -1
+                }
+            ]
+        },
+        "Filters": [
+            {
+                "grok": {
+                    "condition": "\"[EventTypeName]\" == \"Information Event\"",
+                    "match": [
+                        "Text",
+                        ""
+                    ],
+                    "drop": "true"
+                }
+            }
+        ],
+        "Outputs": {
+            "Redis": [
+                {
+                    "_comment": "Change the host to your Redis instance",
+                    "port": 6379,
+                    "batch_count": 500,
+                    "threads":  2,
+                    "host": [
+                        "tstlexiceapp006.vistaprint.svc"
+                    ]
+                }
+            ]
+        }
+    }
+}

TimberWinR.TestGenerator/test3.json

@@ -0,0 +1,14 @@
+{
+    "test": "Test 3",
+    "arguments": {
+        "--testFile": "test3.json",
+        "--testDir": "test3",
+        "--timberWinRConfig": "test3-tw.json",
+        "--numMessages": 1234,
+        "--logLevel": "debug",
+        "--tcp": "5140",
+        "--jroll": ["r1.jlog", "r2.jlog"],
+        "--json": ["1.jlog", "2.jlog", "3.jlog", "4.jlog"],
+        "--resultsFile": "results3.json"
+    }
+}

TimberWinR.UnitTests/Configuration.cs

@@ -85,7 +85,7 @@ namespace TimberWinR.UnitTests
                         [{  
                             ""host"": 
                             [
-                                ""logaggregator.vistaprint.svc""
+                                ""logaggregator.mycompany.svc""
                             ]                   
 		                }]
 	                }
@@ -94,7 +94,7 @@ namespace TimberWinR.UnitTests
 
 
             Configuration c = Configuration.FromString(redisJson);
-            RedisOutput redis = c.RedisOutputs.First() as RedisOutput;
+            RedisOutputParameters redis = c.RedisOutputs.First() as RedisOutputParameters;
             Assert.IsTrue(redis.Host.Length >= 1);
         }
 

TimberWinR.UnitTests/FakeRediServer.cs

@@ -0,0 +1,126 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Net;
+using System.Net.Sockets;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+using NUnit.Framework;
+using TimberWinR.Parser;
+using System.Text;
+using System.Collections.Generic;
+
+namespace TimberWinR.UnitTests
+{   
+    // Class which implements a Fake redis server for test purposes.
+    class FakeRediServer
+    {
+        private readonly System.Net.Sockets.TcpListener _tcpListenerV4;
+        private readonly System.Net.Sockets.TcpListener _tcpListenerV6;
+        private Thread _listenThreadV4;
+        private Thread _listenThreadV6;
+        private readonly int _port;
+        private CancellationToken _cancelToken;
+        private bool _shutdown;     
+
+        public FakeRediServer(CancellationToken cancelToken, int port = 6379)
+        {
+            _port = port;
+            _cancelToken = cancelToken;
+            _shutdown = false;
+
+            _tcpListenerV6 = new System.Net.Sockets.TcpListener(IPAddress.IPv6Any, port);
+            _tcpListenerV4 = new System.Net.Sockets.TcpListener(IPAddress.Any, port);
+
+            _listenThreadV4 = new Thread(new ParameterizedThreadStart(ListenForClients));
+            _listenThreadV4.Start(_tcpListenerV4);
+
+            _listenThreadV6 = new Thread(new ParameterizedThreadStart(ListenForClients));
+            _listenThreadV6.Start(_tcpListenerV6);
+        }
+
+        public void Shutdown()
+        {
+            _shutdown = true;
+            this._tcpListenerV4.Stop();
+            this._tcpListenerV6.Stop();
+        }
+
+
+        private void ListenForClients(object olistener)
+        {
+            System.Net.Sockets.TcpListener listener = olistener as System.Net.Sockets.TcpListener;
+
+            listener.Start();
+
+
+            while (!_cancelToken.IsCancellationRequested && !_shutdown)
+            {
+                try
+                {
+                    //blocks until a client has connected to the server
+                    TcpClient client = listener.AcceptTcpClient();
+
+                    // Wait for a client, spin up a thread.
+                    var clientThread = new Thread(new ParameterizedThreadStart(HandleNewClient));
+                    clientThread.Start(client);
+                }
+                catch (SocketException ex)
+                {
+                    if (ex.SocketErrorCode == SocketError.Interrupted)
+                        break;
+                }
+            }
+        }
+
+        private void HandleNewClient(object client)
+        {
+            var tcpClient = (TcpClient)client;
+
+            try
+            {
+                NetworkStream clientStream = tcpClient.GetStream();
+                int i;
+                Byte[] bytes = new Byte[16535];
+                String data = null;
+
+                do
+                {
+                    try
+                    {
+                        // Loop to receive all the data sent by the client.
+                        while ((i = clientStream.Read(bytes, 0, bytes.Length)) != 0)
+                        {
+                            // Translate data bytes to a ASCII string.
+                            data = System.Text.Encoding.ASCII.GetString(bytes, 0, i);
+                            //System.Diagnostics.Debug.WriteLine(String.Format("Received: {0}", data));
+
+                            // Process the data sent by the client.
+                            data = ":1000\r\n";
+
+                            byte[] msg = System.Text.Encoding.ASCII.GetBytes(data);
+
+                            // Send back a response.
+                            clientStream.Write(msg, 0, msg.Length);
+                          //  System.Diagnostics.Debug.WriteLine(String.Format("Sent: {0}", data));
+                        }
+                    }
+                    catch (IOException)
+                    {                       
+                    }
+                } while (true);
+            }
+            catch (Exception ex)
+            {
+                System.Diagnostics.Debug.WriteLine(ex.ToString());
+            }
+            tcpClient.Close();
+        }
+
+        private void ProcessJson(JObject json)
+        {
+            Console.WriteLine(json.ToString());
+        }
+
+    }
+}

TimberWinR.UnitTests/GrokFilterTests.cs

@@ -22,7 +22,7 @@ namespace TimberWinR.UnitTests
                 {"Index", 7},
                 {"Text", null},
                 {"type", "Win32-FileLog"},
-                {"ComputerName", "dev.vistaprint.net"}
+                {"ComputerName", "dev.mycompany.net"}
             };
 
             string grokJson = @"{  
@@ -55,7 +55,7 @@ namespace TimberWinR.UnitTests
             Assert.IsTrue(grok.Apply(json));
 
             // Verify host field added
-            Assert.AreEqual(json["host"].ToString(), "dev.vistaprint.net");
+            Assert.AreEqual(json["host"].ToString(), "dev.mycompany.net");
 
             // Verify two tags added
             Assert.AreEqual(json["tags"][0].ToString(), "rn_7");
@@ -71,7 +71,7 @@ namespace TimberWinR.UnitTests
                 {"Index", 7},
                 {"Text", "crap"},
                 {"type", "Win32-FileLog"},
-                {"ComputerName", "dev.vistaprint.net"}
+                {"ComputerName", "dev.mycompany.net"}
             };
 
             string grokJson = @"{  
@@ -123,7 +123,7 @@ namespace TimberWinR.UnitTests
                     }
                 },
                 {"type", "Win32-FileLog"},
-                {"ComputerName", "dev.vistaprint.net"}
+                {"ComputerName", "dev.mycompany.net"}
             };
 
             JObject json2 = new JObject
@@ -140,7 +140,7 @@ namespace TimberWinR.UnitTests
                     }
                 },
                 {"type", "Win32-FileLog"},
-                {"ComputerName", "dev.vistaprint.net"}
+                {"ComputerName", "dev.mycompany.net"}
             };
 
 
@@ -223,7 +223,8 @@ namespace TimberWinR.UnitTests
                     }
                 },
                 {"type", "Win32-FileLog"},
-                {"ComputerName", "dev.vistaprint.net"}
+                {"Type", "Win32-MyType"},
+                {"ComputerName", "dev.mycompany.net"}
             };
 
             string grokJson1 = @"{  
@@ -281,11 +282,35 @@ namespace TimberWinR.UnitTests
                 }
             }";
 
-            // Positive Tests
-            Configuration c = Configuration.FromString(grokJson1);
+            string grokJson4 = @"{  
+            ""TimberWinR"":{        
+                ""Filters"":[  
+	                {  
+		            ""grok"":{  
+		                ""condition"": ""!\""[Type]\"".StartsWith(\""[\"") && !\""[Type]\"".EndsWith(\""]\"") && (\""[type]\"" == \""Win32-FileLog\"")"",
+		                ""match"":[  
+			                ""Text"",
+			                """"
+		                ],
+                        ""remove_tag"":[  
+                            ""tag1""                          
+                        ]		               
+		            }
+	                }]
+                }
+            }";
+
+            
+            Configuration c = Configuration.FromString(grokJson4);
             Grok grok = c.Filters.First() as Grok;
             Assert.IsTrue(grok.Apply(json));
 
+
+            // Positive Tests
+            c = Configuration.FromString(grokJson1);
+            grok = c.Filters.First() as Grok;
+            Assert.IsTrue(grok.Apply(json));
+
             c = Configuration.FromString(grokJson2);
             grok = c.Filters.First() as Grok;
             Assert.IsTrue(grok.Apply(json));
@@ -311,7 +336,7 @@ namespace TimberWinR.UnitTests
                     }
                 },
                 {"type", "Win32-FileLog"},
-                {"ComputerName", "dev.vistaprint.net"}
+                {"ComputerName", "dev.mycompany.net"}
             };
 
             string grokJson = @"{  

TimberWinR.UnitTests/Inputs/IisW3CRowReaderTests.cs

@@ -1,60 +0,0 @@
-namespace TimberWinR.UnitTests.Inputs
-{
-    using System;
-    using System.Collections.Generic;
-
-    using Interop.MSUtil;
-
-    using Moq;
-
-    using NUnit.Framework;
-
-    using TimberWinR.Inputs;
-    using TimberWinR.Parser;
-
-    [TestFixture]
-    public class IisW3CRowReaderTests : TestBase
-    {
-        private IisW3CRowReader reader;
-
-        public override void Setup()
-        {
-            base.Setup();
-            var fields = new List<Field>
-                             {
-                                 new Field("date", "DateTime"),
-                                 new Field("time", "DateTime"),
-                                 new Field("uri")
-                             };
-            this.reader = new IisW3CRowReader(fields);
-
-            var recordset = this.GetRecordsetMock();
-            this.reader.ReadColumnMap(recordset.Object);
-        }
-
-        [Test]
-        public void GivenValidRowAddsTimestampColumn()
-        {
-            var record = this.MockRepository.Create<ILogRecord>();
-            record.Setup(x => x.getValue("date")).Returns(new DateTime(2014, 11, 30));
-            record.Setup(x => x.getValue("time")).Returns(new DateTime(1, 1, 1, 18, 45, 37, 590));
-            record.Setup(x => x.getValue("uri")).Returns("http://somedomain.com/someurl");
-
-            var json = this.reader.ReadToJson(record.Object);
-
-            Assert.AreEqual("2014-11-30T18:45:37.000Z", json["@timestamp"].ToString());
-            Assert.AreEqual("http://somedomain.com/someurl", json["uri"].ToString());
-        }
-
-        private Mock<ILogRecordset> GetRecordsetMock()
-        {
-            var recordset = this.MockRepository.Create<ILogRecordset>();
-            recordset.Setup(x => x.getColumnCount()).Returns(3);
-
-            recordset.Setup(x => x.getColumnName(0)).Returns("date");
-            recordset.Setup(x => x.getColumnName(1)).Returns("time");
-            recordset.Setup(x => x.getColumnName(2)).Returns("uri");
-            return recordset;
-        }
-    }
-}

TimberWinR.UnitTests/JsonFilterTests.cs

@@ -20,14 +20,14 @@ namespace TimberWinR.UnitTests
             JObject jsonInputLine1 = new JObject
             {               
                 {"type", "Win32-FileLog"},
-                {"ComputerName", "dev.vistaprint.net"},
+                {"ComputerName", "dev.mycompany.net"},
                 {"Text", "{\"Email\":\"james@example.com\",\"Active\":true,\"CreatedDate\":\"2013-01-20T00:00:00Z\",\"Roles\":[\"User\",\"Admin\"]}"}
             };
 
             JObject jsonInputLine2 = new JObject
             {               
                 {"type", "Win32-FileLog"},
-                {"ComputerName", "dev.vistaprint.net"},
+                {"ComputerName", "dev.mycompany.net"},
                 {"Text", "{\"Email\":\"james@example.com\",\"Active\":true,\"CreatedDate\":\"2013-01-20T00:00:00Z\",\"Roles\":[\"User\",\"Admin\"]}"}
             };
 

TimberWinR.UnitTests/MultilineTests.cs

@@ -3,7 +3,6 @@ using System.Collections.Generic;
 using System.IO;
 using System.Linq;
 using System.Text;
-using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Newtonsoft.Json;
@@ -18,7 +17,7 @@ namespace TimberWinR.UnitTests
     [TestFixture]
     public class MultilineTests
     {
-     //   [Test(Description = "Test using next")]
+       // [Test(Description = "Test using next")]
         public void TestMultiline1()
         {
             using (StreamReader sr = new StreamReader("Multiline1.txt"))
@@ -29,10 +28,10 @@ namespace TimberWinR.UnitTests
 
                 Stdin sin = new Stdin();
 
-                sin.Codec = new Codec();
-                sin.Codec.Pattern = "\\\\$";
-                sin.Codec.What = Codec.WhatType.next;
-                sin.Codec.Type = Codec.CodecType.multiline;
+                sin.CodecArguments = new CodecArguments();
+                sin.CodecArguments.Pattern = "\\\\$";
+                sin.CodecArguments.What = CodecArguments.WhatType.next;
+                sin.CodecArguments.Type = CodecArguments.CodecType.multiline;
 
                 var cancelTokenSource = new CancellationTokenSource();
 
@@ -52,7 +51,7 @@ namespace TimberWinR.UnitTests
                         if (!cancelTokenSource.Token.IsCancellationRequested)
                             syncHandle.Wait(TimeSpan.FromSeconds(10000), cancelTokenSource.Token);
                     }
-                    catch (OperationCanceledException oex)
+                    catch (OperationCanceledException)
                     {
                     }
                 }
@@ -67,7 +66,7 @@ namespace TimberWinR.UnitTests
             }
         }
 
-    //    [Test(Description = "Test using previous")]
+     //   [Test(Description = "Test using previous")]
         public void TestMultiline2()
         {
             using (StreamReader sr = new StreamReader("Multiline2.txt"))
@@ -78,11 +77,11 @@ namespace TimberWinR.UnitTests
 
                 Stdin sin = new Stdin();
 
-                sin.Codec = new Codec();
-                sin.Codec.Pattern = "^(\\d{4}-\\d{2}-\\d{2}\\s\\d{2}:\\d{2}:\\d{2},\\d{3})(.*)$";              
-                sin.Codec.What = Codec.WhatType.previous;
-                sin.Codec.Type = Codec.CodecType.multiline;
-                sin.Codec.Negate = true;
+                sin.CodecArguments = new CodecArguments();
+                sin.CodecArguments.Pattern = "^(\\d{4}-\\d{2}-\\d{2}\\s\\d{2}:\\d{2}:\\d{2},\\d{3})(.*)$";              
+                sin.CodecArguments.What = CodecArguments.WhatType.previous;
+                sin.CodecArguments.Type = CodecArguments.CodecType.multiline;
+                sin.CodecArguments.Negate = true;
 
                 var cancelTokenSource = new CancellationTokenSource();
 
@@ -102,7 +101,7 @@ namespace TimberWinR.UnitTests
                         if (!cancelTokenSource.Token.IsCancellationRequested)
                             syncHandle.Wait(TimeSpan.FromSeconds(10000), cancelTokenSource.Token);
                     }
-                    catch (OperationCanceledException oex)
+                    catch (OperationCanceledException)
                     {
                     }
                 }

TimberWinR.UnitTests/Parser/ElasticsearchOutputTests.cs

@@ -10,12 +10,12 @@
 
     public class ElasticsearchOutputTests
     {
-        private ElasticsearchOutput parser;
+        private ElasticsearchOutputParameters parser;
 
         [SetUp]
         public void Setup()
         {
-            this.parser = new ElasticsearchOutput();
+            this.parser = new ElasticsearchOutputParameters();
         }
 
         [Test]

TimberWinR.UnitTests/TailFileTests.cs

@@ -0,0 +1,89 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Newtonsoft.Json;
+using NUnit.Framework;
+using TimberWinR.Inputs;
+using TimberWinR.Parser;
+using Newtonsoft.Json.Linq;
+using System.Diagnostics;
+
+namespace TimberWinR.UnitTests
+{
+    [TestFixture]
+    public class TailFileTests
+    {
+        [Test]
+        public void TestTailFile()
+        {
+            List<JObject> events = new List<JObject>();
+
+            if (File.Exists(".timberwinrdb"))
+                File.Delete(".timberwinrdb");
+
+            var mgr = new Manager();
+            mgr.LogfileDir = ".";
+
+            var tf = new TailFileArguments();
+            var cancelTokenSource = new CancellationTokenSource();
+            tf.Location = "TestTailFile1.log";
+
+   
+            if (File.Exists(tf.Location))
+                File.Delete(tf.Location);
+
+            try
+            {
+                var listener = new TailFileListener(tf, cancelTokenSource.Token);
+
+                listener.OnMessageRecieved += o =>
+                {
+                    events.Add(o);
+                    if (events.Count >= 100)
+                        cancelTokenSource.Cancel();
+                };
+
+                GenerateLogFile(tf.Location);
+
+                bool createdFile = false;
+                while (!listener.Stop && !cancelTokenSource.IsCancellationRequested)
+                {
+                    Thread.Sleep(100);
+                    if (!createdFile)
+                    {
+                        GenerateLogFile(tf.Location);
+                        createdFile = true;
+                    }
+                }
+            }
+            catch (OperationCanceledException)
+            {
+                Console.WriteLine("Done!");
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine(ex.ToString());
+
+            }
+            finally
+            {
+                Assert.AreEqual(100, events.Count);
+            }
+        }
+
+        private static void GenerateLogFile(string fileName)
+        {
+            using (System.IO.StreamWriter file = new System.IO.StreamWriter(fileName))
+            {
+                for (int i = 0; i < 100; i++)
+                {
+                    file.WriteLine("Log Line Number {0}", i);
+                }
+            }
+        }
+    }
+}

TimberWinR.UnitTests/TestBase.cs

@@ -1,23 +0,0 @@
-namespace TimberWinR.UnitTests
-{
-    using Moq;
-
-    using NUnit.Framework;
-
-    public class TestBase
-    {
-        public MockRepository MockRepository { get; private set; }
-
-        [SetUp]
-        public virtual void Setup()
-        {
-            this.MockRepository = new MockRepository(MockBehavior.Default);
-        }
-
-        [TearDown]
-        public virtual void TearDown()
-        {
-            this.MockRepository.VerifyAll();
-        }
-    }
-}

TimberWinR.UnitTests/TestDynamicBatchCount.cs

@@ -0,0 +1,89 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using Newtonsoft.Json;
+using NUnit.Framework;
+using TimberWinR.Parser;
+using Newtonsoft.Json.Linq;
+using System.Threading;
+
+
+namespace TimberWinR.UnitTests
+{
+    [TestFixture]
+    public class TestDynamicBatchCount
+    {
+   //     [Test]
+        public void TestDynamicBatch()
+        {
+            var mgr = new Manager();
+            mgr.LogfileDir = ".";
+
+            mgr.Config = new Configuration();
+
+            CancellationTokenSource cancelTokenSource = new CancellationTokenSource();
+
+            var cancelToken = cancelTokenSource.Token;
+
+            FakeRediServer fr = new FakeRediServer(cancelToken);
+
+            var redisParams = new RedisOutputParameters();
+            redisParams.BatchCount = 10;
+            redisParams.MaxBatchCount = 40;
+            redisParams.Interval = 100;
+
+            var redisOutput = new Outputs.RedisOutput(mgr, redisParams, cancelToken);
+
+
+            // Message is irrelavant
+            JObject jsonMessage = new JObject
+            {               
+                {"type", "Win32-FileLog"},
+                {"ComputerName", "dev.vistaprint.net"},
+                {"Text", "{\"Email\":\"james@example.com\",\"Active\":true,\"CreatedDate\":\"2013-01-20T00:00:00Z\",\"Roles\":[\"User\",\"Admin\"]}"}
+            };
+            
+                     
+            // Send 1000 messages at max throttle
+            for (int i = 0; i < 1000; i++)
+            {
+                Thread.Sleep(10);
+                redisOutput.Startup(jsonMessage);             
+            }
+
+            while (redisOutput.SentMessages < 1000)
+            {
+                System.Diagnostics.Debug.WriteLine(redisOutput.SentMessages);
+                Thread.Sleep(1000);
+            }
+
+            fr.Shutdown();
+
+            cancelTokenSource.Cancel();
+
+            System.Diagnostics.Debug.WriteLine(redisOutput.ToJson());
+            System.Diagnostics.Debug.WriteLine(redisOutput.QueueDepth);
+
+            JObject json = redisOutput.ToJson();
+            var mbc = json["redis"]["reachedMaxBatchCountTimes"].Value<int>();
+            var sm = json["redis"]["sentMessageCount"].Value<int>();
+            var errs = json["redis"]["errors"].Value<int>();
+            var cbc = json["redis"]["currentBatchCount"].Value<int>();
+            
+            // No errors
+            Assert.AreEqual(0, errs);          
+              
+            // Should have reached max at least 1 time
+            Assert.GreaterOrEqual(mbc, 1);
+
+            // Should have sent 1000 messages
+            Assert.AreEqual(1000, sm);
+
+            // Should reset back down to original
+            Assert.AreEqual(cbc, 10);
+        }
+    }
+}

TimberWinR.UnitTests/TimberWinR.UnitTests.csproj

@@ -12,6 +12,8 @@
     <TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
     <FileAlignment>512</FileAlignment>
     <TargetFrameworkProfile />
+    <SolutionDir Condition="$(SolutionDir) == '' Or $(SolutionDir) == '*Undefined*'">..\</SolutionDir>
+    <RestorePackages>true</RestorePackages>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -38,16 +40,13 @@
       <EmbedInteropTypes>False</EmbedInteropTypes>
       <HintPath>..\TimberWinR\lib\com-logparser\Interop.MSUtil.dll</HintPath>
     </Reference>
-    <Reference Include="Moq">
-      <HintPath>..\packages\Moq.4.2.1409.1722\lib\net40\Moq.dll</HintPath>
-    </Reference>
     <Reference Include="Newtonsoft.Json, Version=6.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
       <SpecificVersion>False</SpecificVersion>
-      <HintPath>..\packages\Newtonsoft.Json.6.0.4\lib\net40\Newtonsoft.Json.dll</HintPath>
+      <HintPath>..\packages\Newtonsoft.Json.6.0.8\lib\net40\Newtonsoft.Json.dll</HintPath>
+      <Private>True</Private>
     </Reference>
-    <Reference Include="nunit.framework, Version=2.6.3.13283, Culture=neutral, PublicKeyToken=96d09a1eb7f44a77, processorArchitecture=MSIL">
-      <SpecificVersion>False</SpecificVersion>
-      <HintPath>..\packages\NUnit.2.6.3\lib\nunit.framework.dll</HintPath>
+    <Reference Include="nunit.framework">
+      <HintPath>..\packages\NUnit.2.6.4\lib\nunit.framework.dll</HintPath>
     </Reference>
     <Reference Include="System" />
     <Reference Include="System.Core" />
@@ -60,14 +59,15 @@
   <ItemGroup>
     <Compile Include="Configuration.cs" />
     <Compile Include="DateFilterTests.cs" />
+    <Compile Include="FakeRediServer.cs" />
     <Compile Include="GeoIPFilterTests.cs" />
-    <Compile Include="Inputs\IisW3CRowReaderTests.cs" />
     <Compile Include="JsonFilterTests.cs" />
     <Compile Include="GrokFilterTests.cs" />
     <Compile Include="MultilineTests.cs" />
     <Compile Include="Parser\ElasticsearchOutputTests.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
-    <Compile Include="TestBase.cs" />
+    <Compile Include="TailFileTests.cs" />
+    <Compile Include="TestDynamicBatchCount.cs" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\TimberWinR\TimberWinR.csproj">
@@ -79,6 +79,7 @@
     <Service Include="{82A7F48D-3B50-4B1E-B82E-3ADA8210C358}" />
   </ItemGroup>
   <ItemGroup>
+    <None Include="app.config" />
     <None Include="packages.config">
       <SubType>Designer</SubType>
     </None>
@@ -91,7 +92,17 @@
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
     </Content>
   </ItemGroup>
+  <ItemGroup>
+    <Folder Include="Inputs\" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <Import Project="$(SolutionDir)\.nuget\NuGet.targets" Condition="Exists('$(SolutionDir)\.nuget\NuGet.targets')" />
+  <Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
+    <PropertyGroup>
+      <ErrorText>This project references NuGet package(s) that are missing on this computer. Enable NuGet Package Restore to download them.  For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
+    </PropertyGroup>
+    <Error Condition="!Exists('$(SolutionDir)\.nuget\NuGet.targets')" Text="$([System.String]::Format('$(ErrorText)', '$(SolutionDir)\.nuget\NuGet.targets'))" />
+  </Target>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">

TimberWinR.UnitTests/app.config

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <runtime>
+    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
+      <dependentAssembly>
+        <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
+        <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />
+      </dependentAssembly>
+    </assemblyBinding>
+  </runtime>
+</configuration>

TimberWinR.UnitTests/packages.config

@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<packages>
-  <package id="Moq" version="4.2.1409.1722" targetFramework="net40" />
-  <package id="Newtonsoft.Json" version="6.0.4" targetFramework="net40" />
-  <package id="NUnit" version="2.6.3" targetFramework="net40" />
+<packages> 
+  <package id="Newtonsoft.Json" version="6.0.8" targetFramework="net40" />
+  <package id="NUnit" version="2.6.4" targetFramework="net40" />
 </packages>

TimberWinR.sln

@@ -7,6 +7,9 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TimberWinR", "TimberWinR\Ti
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = ".nuget", ".nuget", "{2C4AC7DB-018D-4CCA-9579-06AC5AD2C9D9}"
 	ProjectSection(SolutionItems) = preProject
+		.nuget\NuGet.Config = .nuget\NuGet.Config
+		.nuget\NuGet.exe = .nuget\NuGet.exe
+		.nuget\NuGet.targets = .nuget\NuGet.targets
 		.nuget\packages.config = .nuget\packages.config
 	EndProjectSection
 EndProject
@@ -21,6 +24,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
 		chocolateyInstall.ps1.template = chocolateyInstall.ps1.template
 		chocolateyUninstall.ps1.guid = chocolateyUninstall.ps1.guid
 		chocolateyUninstall.ps1.template = chocolateyUninstall.ps1.template
+		chocolateyUninstall.ps1.template.orig = chocolateyUninstall.ps1.template.orig
 		LICENSE.txt = LICENSE.txt
 		Performance1.psess = Performance1.psess
 		README.md = README.md
@@ -34,6 +38,8 @@ Project("{930C7802-8A8C-48F9-8165-68863BCCD9DD}") = "TimberWinR.Wix", "TimberWix
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TimberWinR.ExtractID", "TimberWinR.ExtractID\TimberWinR.ExtractID.csproj", "{99096939-E9DD-4499-883D-4726745A5843}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TimberWinR.TestGenerator", "TimberWinR.TestGenerator\TimberWinR.TestGenerator.csproj", "{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -96,11 +102,18 @@ Global
 		{99096939-E9DD-4499-883D-4726745A5843}.Release|Mixed Platforms.ActiveCfg = Release|Any CPU
 		{99096939-E9DD-4499-883D-4726745A5843}.Release|Mixed Platforms.Build.0 = Release|Any CPU
 		{99096939-E9DD-4499-883D-4726745A5843}.Release|x86.ActiveCfg = Release|Any CPU
+		{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}.Debug|Mixed Platforms.ActiveCfg = Debug|Any CPU
+		{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}.Debug|Mixed Platforms.Build.0 = Debug|Any CPU
+		{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}.Release|Any CPU.Build.0 = Release|Any CPU
+		{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}.Release|Mixed Platforms.ActiveCfg = Release|Any CPU
+		{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}.Release|Mixed Platforms.Build.0 = Release|Any CPU
+		{F3960D6E-1EA0-4F4E-8F08-82FC185A0D29}.Release|x86.ActiveCfg = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
 	EndGlobalSection
-	GlobalSection(Performance) = preSolution
-		HasPerformanceSessions = true
-	EndGlobalSection
 EndGlobal

TimberWinR/Codecs/Multiline.cs

@@ -0,0 +1,90 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using Newtonsoft.Json.Linq;
+using TimberWinR.Inputs;
+using TimberWinR.Parser;
+
+namespace TimberWinR.Codecs
+{
+    public class Multiline : ICodec
+    {
+        private CodecArguments _codecArguments;
+        private List<string> _multiline { get; set; }
+
+        // return true to cancel codec
+        public Multiline(CodecArguments args)
+        {
+            _codecArguments = args;
+        }
+
+        public void Apply(string msg, InputListener listener)
+        {
+            if (_codecArguments.Re == null)
+                _codecArguments.Re = new Regex(_codecArguments.Pattern);
+
+            Match match = _codecArguments.Re.Match(msg);
+
+            bool isMatch = (match.Success && !_codecArguments.Negate) || (!match.Success && _codecArguments.Negate);
+
+            switch (_codecArguments.What)
+            {
+                case CodecArguments.WhatType.previous:
+                    if (isMatch)
+                    {
+                        if (_multiline == null)
+                            _multiline = new List<string>();
+
+                        _multiline.Add(msg);
+                    }
+                    else // No Match
+                    {
+                        if (_multiline != null)
+                        {
+                            string single = string.Join("\n", _multiline.ToArray());
+                            _multiline = null;
+                            JObject jo = new JObject();
+                            jo["message"] = single;
+                            jo.Add("tags", new JArray(_codecArguments.MultilineTag));
+                            listener.AddDefaultFields(jo);
+                            listener.ProcessJson(jo);
+                        }
+                        _multiline = new List<string>();
+                        _multiline.Add(msg);
+                    }
+                    break;
+                case CodecArguments.WhatType.next:
+                    if (isMatch)
+                    {
+                        if (_multiline == null)
+                            _multiline = new List<string>();
+                        _multiline.Add(msg);
+                    }
+                    else // No match
+                    {
+                        if (_multiline != null)
+                        {
+                            _multiline.Add(msg);
+                            string single = string.Join("\n", _multiline.ToArray());
+                            _multiline = null;
+                            JObject jo = new JObject();
+                            jo["message"] = single;
+                            jo.Add("tags", new JArray(_codecArguments.MultilineTag));
+                            listener.AddDefaultFields(jo);
+                            listener.ProcessJson(jo);
+                        }
+                        else
+                        {
+                            JObject jo = new JObject();
+                            jo["message"] = msg;
+                            listener.AddDefaultFields(jo);
+                            listener.ProcessJson(jo);
+                        }
+                    }
+                    break;
+            }
+        }
+    }
+}

TimberWinR/Configuration.cs

@@ -4,6 +4,8 @@ using System.Data.Odbc;
 using System.Diagnostics;
 using System.Linq;
 using System.Reflection;
+using System.Threading;
+using System.Threading.Tasks;
 using System.Text;
 using System.Xml;
 using System.Xml.Linq;
@@ -16,69 +18,80 @@ using Newtonsoft.Json.Linq;
 using TimberWinR.Inputs;
 using TimberWinR.Filters;
 
+
 using NLog;
 using TimberWinR.Parser;
 using Topshelf.Configurators;
-using IISW3CLog = TimberWinR.Parser.IISW3CLog;
 using WindowsEvent = TimberWinR.Parser.WindowsEvent;
 
 namespace TimberWinR
 {
     public class Configuration
-    {
+    {       
+        private CancellationToken _cancelToken;
+        
+        private FileSystemWatcher _dirWatcher;
+        private Manager _manager;
+ 
         private List<WindowsEvent> _events = new List<WindowsEvent>();
         public IEnumerable<WindowsEvent> Events
         {
             get { return _events; }
         }
 
-        private List<RedisOutput> _redisOutputs = new List<RedisOutput>();
-        public IEnumerable<RedisOutput> RedisOutputs
+        private List<RedisOutputParameters> _redisOutputs = new List<RedisOutputParameters>();
+        public IEnumerable<RedisOutputParameters> RedisOutputs
         {
             get { return _redisOutputs; }
         }
+       
 
-
-        private List<ElasticsearchOutput> _elasticsearchOutputs = new List<ElasticsearchOutput>();
-        public IEnumerable<ElasticsearchOutput> ElasticsearchOutputs
+        private List<ElasticsearchOutputParameters> _elasticsearchOutputs = new List<ElasticsearchOutputParameters>();
+        public IEnumerable<ElasticsearchOutputParameters> ElasticsearchOutputs
         {
             get { return _elasticsearchOutputs; }
         }
 
-        private List<StdoutOutput> _stdoutOutputs = new List<StdoutOutput>();
-        public IEnumerable<StdoutOutput> StdoutOutputs
+        private List<StdoutOutputParameters> _stdoutOutputs = new List<StdoutOutputParameters>();
+        public IEnumerable<StdoutOutputParameters> StdoutOutputs
         {
             get { return _stdoutOutputs; }
         }
 
-        private List<Tcp> _tcps = new List<Tcp>();
-        public IEnumerable<Tcp> Tcps
+        private List<TcpParameters> _tcps = new List<TcpParameters>();
+        public IEnumerable<TcpParameters> Tcps
         {
             get { return _tcps; }
         }
 
-        private List<Udp> _udps = new List<Udp>();
-        public IEnumerable<Udp> Udps
+        private List<UdpParameters> _udps = new List<UdpParameters>();
+        public IEnumerable<UdpParameters> Udps
         {
             get { return _udps; }
         }     
 
-        private List<Log> _logs = new List<Log>();
-        public IEnumerable<Log> Logs
+        private List<LogParameters> _logs = new List<LogParameters>();
+        public IEnumerable<LogParameters> Logs
         {
             get { return _logs; }
-        }       
+        }
 
-        private List<IISW3CLog> _iisw3clogs = new List<IISW3CLog>();
+        private List<TailFileArguments> _tails = new List<TailFileArguments>();
+        public IEnumerable<TailFileArguments> TailFiles
+        {
+            get { return _tails; }
+        }    
 
-        public IEnumerable<IISW3CLog> IISW3C
+        private List<IISW3CLogParameters> _iisw3clogs = new List<IISW3CLogParameters>();
+
+        public IEnumerable<IISW3CLogParameters> IISW3C
         {
             get { return _iisw3clogs; }
         }
 
-        private List<W3CLog> _w3clogs = new List<W3CLog>();
+        private List<W3CLogParameters> _w3clogs = new List<W3CLogParameters>();
 
-        public IEnumerable<W3CLog> W3C
+        public IEnumerable<W3CLogParameters> W3C
         {
             get { return _w3clogs; }
         }
@@ -96,11 +109,87 @@ namespace TimberWinR
             get { return _filters; }
         }
 
+        private void MonitorDirectory(string directoryToWatch, CancellationToken cancelToken, Manager manager)
+        {
+            _manager = manager;
+            _cancelToken = cancelToken;
+            if (_dirWatcher == null)
+            {
+                _dirWatcher = new FileSystemWatcher();
+                _dirWatcher.Path = directoryToWatch;
+                _dirWatcher.NotifyFilter = NotifyFilters.LastAccess | NotifyFilters.LastWrite | NotifyFilters.FileName | NotifyFilters.DirectoryName;
+                // Only watch json files.
+                _dirWatcher.Filter = "*.json";
+                _dirWatcher.Created += DirWatcherOnCreated;
+                _dirWatcher.Changed += DirWatcherOnChanged;
+                _dirWatcher.Renamed += DirWatcherOnRenamed;
+                _dirWatcher.EnableRaisingEvents = true;
+            }       
+        }
 
-        public static Configuration FromDirectory(string jsonDirectory)
+        private void DirWatcherOnRenamed(object sender, RenamedEventArgs e)
+        {
+            // The Renamed file could be a different name from .json
+            FileInfo fi = new FileInfo(e.FullPath);
+            if (fi.Extension == ".json")
+            {
+                LogManager.GetCurrentClassLogger().Info("File: OnRenamed " + e.FullPath + " " + e.ChangeType);
+                ProcessNewJson(e.FullPath);
+            }
+        }
+
+        private void DirWatcherOnCreated(object sender, FileSystemEventArgs e)
+        {
+            FileInfo fi = new FileInfo(e.FullPath);
+            if (fi.Extension == ".json")
+            {
+                LogManager.GetCurrentClassLogger().Info("File: OnCreated " + e.FullPath + " " + e.ChangeType);
+                ProcessNewJson(e.FullPath);
+            }
+        }
+
+        private void DirWatcherOnChanged(object sender, FileSystemEventArgs e)
+        {
+            FileInfo fi = new FileInfo(e.FullPath);
+            if (fi.Extension == ".json")
+            {
+                // Specify what is done when a file is changed, created, or deleted.
+                LogManager.GetCurrentClassLogger()
+                    .Info("File: OnChanged " + e.ChangeType.ToString() + " " + e.FullPath + " " + e.ChangeType);
+                ProcessNewJson(e.FullPath);
+            }
+        }
+      
+        private void ProcessNewJson(string fileName)
+        {
+            try
+            {
+                Configuration c = new Configuration();
+                var config = Configuration.FromFile(fileName, c);
+                _manager.ProcessConfiguration(_cancelToken, config);
+
+            }
+            catch (Exception ex)
+            {
+                LogManager.GetCurrentClassLogger().Error(ex);                         
+            }
+        }
+
+        private void ShutdownDirectoryMonitor()
+        {           
+            _dirWatcher.EnableRaisingEvents = false;
+            LogManager.GetCurrentClassLogger().Info("Stopping Directory Monitor");            
+        }
+
+        private void DirectoryWatcher(string directoryToWatch)
+        {
+            LogManager.GetCurrentClassLogger().Info("Starting Directory Monitor {0}", directoryToWatch);                       
+        }
+
+        public static Configuration FromDirectory(string jsonDirectory, CancellationToken cancelToken, Manager manager)
         {
             Configuration c = null;
-
+      
             foreach (string jsonConfFile in Directory.GetFiles(jsonDirectory, "*.json"))
             {
                 if (!string.IsNullOrEmpty(jsonConfFile))
@@ -109,6 +198,10 @@ namespace TimberWinR
                 }
             }
 
+            // Startup Directory Monitor
+            if (manager.LiveMonitor)           
+                c.MonitorDirectory(jsonDirectory, cancelToken, manager);            
+
             return c;
         }
 
@@ -148,6 +241,8 @@ namespace TimberWinR
                     c._stdins.AddRange(x.TimberWinR.Inputs.Stdins.ToList());
                 if (x.TimberWinR.Inputs.Logs != null)
                     c._logs.AddRange(x.TimberWinR.Inputs.Logs.ToList());
+                if (x.TimberWinR.Inputs.TailFilesArguments != null)
+                    c._tails.AddRange(x.TimberWinR.Inputs.TailFilesArguments.ToList());
                 if (x.TimberWinR.Inputs.Tcps != null)
                     c._tcps.AddRange(x.TimberWinR.Inputs.Tcps.ToList());
                 if (x.TimberWinR.Inputs.Udps != null)
@@ -194,13 +289,13 @@ namespace TimberWinR
         {
             _filters = new List<LogstashFilter>();
             _events = new List<WindowsEvent>();
-            _iisw3clogs = new List<IISW3CLog>();
-            _logs = new List<Log>();
-            _redisOutputs = new List<RedisOutput>();
-            _elasticsearchOutputs = new List<ElasticsearchOutput>();
-            _stdoutOutputs = new List<StdoutOutput>();
-            _tcps = new List<Tcp>();
-            _udps = new List<Udp>();
+            _iisw3clogs = new List<IISW3CLogParameters>();
+            _logs = new List<LogParameters>();
+            _redisOutputs = new List<RedisOutputParameters>();
+            _elasticsearchOutputs = new List<ElasticsearchOutputParameters>();
+            _stdoutOutputs = new List<StdoutOutputParameters>();
+            _tcps = new List<TcpParameters>();
+            _udps = new List<UdpParameters>();
         }
 
         public static Object GetPropValue(String name, Object obj)

TimberWinR/Diagnostics/Diagnostics.cs

@@ -21,7 +21,7 @@ namespace TimberWinR.Diagnostics
         private CancellationToken CancelToken { get; set; }
         public int Port { get; set; }
         public Manager Manager { get; set; }
-
+        public bool Stop { get; set; }
         private HttpListener web;
 
         public Diagnostics(Manager manager, CancellationToken cancelToken, int port = 5141)
@@ -49,44 +49,60 @@ namespace TimberWinR.Diagnostics
         }
 
 
-        private void DiagnosticCallback(IAsyncResult result)
-        {       
-            if (web == null)         
-                return;
-
-            var context = web.EndGetContext(result);
-            var response = context.Response;
-
+        public JObject DiagnosticsOutput()
+        {
             JObject json = new JObject(
-                new JProperty("timberwinr",
-                    new JObject(
-                        new JProperty("version", GetAssemblyByName("TimberWinR.ServiceHost").GetName().Version.ToString()),
-                        new JProperty("messages", Manager.NumMessages),
-                        new JProperty("startedon", Manager.StartedOn),
-                        new JProperty("configfile", Manager.JsonConfig),
-                        new JProperty("logdir", Manager.LogfileDir),
-                        new JProperty("logginglevel", LogManager.GlobalThreshold.ToString()),
-                        new JProperty("inputs",
-                            new JArray(
-                                from i in Manager.Listeners
-                                select new JObject(i.ToJson()))),
-                        new JProperty("filters",
-                            new JArray(
-                                from f in Manager.Config.Filters
-                                select new JObject(f.ToJson()))),
-                        new JProperty("outputs",
-                            new JArray(
-                                from o in Manager.Outputs
-                                select new JObject(o.ToJson()))))));
-
-            response.StatusCode = (int)HttpStatusCode.OK;
-            response.StatusDescription = HttpStatusCode.OK.ToString();
-            byte[] buffer = Encoding.UTF8.GetBytes(json.ToString());
-            response.ContentLength64 = buffer.Length;
-            response.OutputStream.Write(buffer, 0, buffer.Length);
-            response.OutputStream.Close();
+                           new JProperty("timberwinr",
+                               new JObject(
+                                   new JProperty("version", Assembly.GetEntryAssembly().GetName().Version.ToString()),
+                                   new JProperty("messages", Manager.NumMessages),
+                                   new JProperty("startedon", Manager.StartedOn),
+                                   new JProperty("configfile", Manager.JsonConfig),
+                                   new JProperty("logdir", Manager.LogfileDir),
+                                   new JProperty("logginglevel", LogManager.GlobalThreshold.ToString()),
+                                   new JProperty("inputs",
+                                       new JArray(
+                                           from i in Manager.Listeners
+                                           select new JObject(i.ToJson()))),
+                                   new JProperty("filters",
+                                       new JArray(
+                                           from f in Manager.Config.Filters
+                                           select new JObject(f.ToJson()))),
+                                   new JProperty("outputs",
+                                       new JArray(
+                                           from o in Manager.Outputs
+                                           select new JObject(o.ToJson()))))));
+            return json;
         }
 
+        private void DiagnosticCallback(IAsyncResult result)
+        {
+            if (web == null)
+                return;
+
+            try
+            {
+                var context = web.EndGetContext(result);
+                var response = context.Response;
+                var json = DiagnosticsOutput();
+
+                response.StatusCode = (int) HttpStatusCode.OK;
+                response.StatusDescription = HttpStatusCode.OK.ToString();
+                byte[] buffer = Encoding.UTF8.GetBytes(json.ToString());
+                response.ContentLength64 = buffer.Length;
+                response.OutputStream.Write(buffer, 0, buffer.Length);
+                response.OutputStream.Close();
+            }
+            catch (SocketException)
+            {
+                // Shutdown
+            }
+            catch (Exception ex)
+            {
+                if (!Stop)
+                    LogManager.GetCurrentClassLogger().Error(ex);
+            }
+        }
 
         private void HttpListen(object o)
         {
@@ -97,14 +113,19 @@ namespace TimberWinR.Diagnostics
                 web.Start();
 
                 while (web != null && web.IsListening)
-                {                  
-                    processRequest();                  
-                }               
+                {
+                    processRequest();
+                }
+            }
+            catch (SocketException)
+            {
+                // Shutdown
             }
             catch (Exception ex)
             {
+                if (!Stop)
                 LogManager.GetCurrentClassLogger().Error("Diagnostic Listener Error: {0}", ex.ToString());
-            }           
+            }
         }
 
         private void ListenForClients(object olistener)
@@ -140,7 +161,7 @@ namespace TimberWinR.Diagnostics
             var tcpClient = (TcpClient)client;
             NetworkStream clientStream = null;
 
-            Console.WriteLine("Handle new diag client: {0}, {1}", tcpClient.Connected, tcpClient.Client.RemoteEndPoint.ToString());
+            //     Console.WriteLine("Handle new diag client: {0}, {1}", tcpClient.Connected, tcpClient.Client.RemoteEndPoint.ToString());
             try
             {
                 using (clientStream = tcpClient.GetStream())
@@ -183,7 +204,7 @@ namespace TimberWinR.Diagnostics
 
         public void Shutdown()
         {
-            
+            Stop = true;
             try
             {
                 if (web != null && web.IsListening)
@@ -193,11 +214,9 @@ namespace TimberWinR.Diagnostics
                     web = null;
                 }
             }
-            catch (Exception ex)
+            catch (Exception)
             {
-                LogManager.GetCurrentClassLogger().Error(ex);
             }
         }
-
     }
 }

TimberWinR/Filters/GrokFilter.cs

@@ -47,6 +47,7 @@ namespace TimberWinR.Parser
                          new JProperty("condition", Condition),
                          new JProperty("addfields", AddField),
                          new JProperty("addtags", AddTag),
+                         new JProperty("drop", DropIfMatch),
                          new JProperty("type", Type),
                          new JProperty("removefields", RemoveField),
                          new JProperty("removetag", RemoveTag)

TimberWinR/ICodec.cs

@@ -0,0 +1,13 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using TimberWinR.Inputs;
+
+namespace TimberWinR
+{
+    public interface ICodec
+    {
+        void Apply(string msg, InputListener listener);
+    }
+}

TimberWinR/Inputs/IISW3CInputListener.cs

@@ -16,12 +16,12 @@ namespace TimberWinR.Inputs
     public class IISW3CInputListener : InputListener
     {
         private readonly int _pollingIntervalInSeconds;
-        private readonly Parser.IISW3CLog _arguments;
+        private readonly Parser.IISW3CLogParameters _arguments;
         private long _receivedMessages;
         public bool Stop { get; set; }
         private IisW3CRowReader rowReader;      
 
-        public IISW3CInputListener(Parser.IISW3CLog arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 5)
+        public IISW3CInputListener(Parser.IISW3CLogParameters arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 5)
             : base(cancelToken, "Win32-IISLog")
         {          
             _arguments = arguments;
@@ -138,7 +138,7 @@ namespace TimberWinR.Inputs
                             if (!Stop)
                                 syncHandle.Wait(TimeSpan.FromSeconds(_pollingIntervalInSeconds), CancelToken);
                         }
-                        catch (OperationCanceledException oce)
+                        catch (OperationCanceledException)
                         {
                             break;
                         }

TimberWinR/Inputs/InputListener.cs

@@ -1,5 +1,6 @@
 using System.IO;
 using System.Runtime.InteropServices;
+using Microsoft.Win32;
 using Newtonsoft.Json.Linq;
 using System;
 using System.Collections.Generic;
@@ -18,7 +19,9 @@ namespace TimberWinR.Inputs
         private string _typeName;
         public AutoResetEvent FinishedEvent { get; set; }
         public string CheckpointFileName { get; set; }
-      
+        private object _locker = new object();
+        public List<string> Files { get; set; }
+
         public string InputType
         {
             get { return _typeName; }
@@ -28,6 +31,7 @@ namespace TimberWinR.Inputs
 
         public InputListener(CancellationToken token, string typeName)
         {
+            Files = new List<string>();
             CheckpointFileName = Path.Combine(System.IO.Path.GetTempPath(), string.Format("{0}.lpc", Guid.NewGuid().ToString()));          
           
             this.FinishedEvent = new AutoResetEvent(false);
@@ -40,6 +44,19 @@ namespace TimberWinR.Inputs
                              .ToString();    
         }
 
+        public bool HaveSeenFile(string fileName)
+        {
+            return Files.Contains(fileName);
+        }
+
+        protected void SaveVisitedFileName(string fileName)
+        {
+            lock (_locker)
+            {
+                if (!HaveSeenFile(fileName))
+                    Files.Add(fileName);
+            }
+        }
         protected string ToPrintable(string inputString)
         {
             string asAscii = Encoding.ASCII.GetString(
@@ -58,17 +75,17 @@ namespace TimberWinR.Inputs
 
         public void Finished()
         {
-            LogManager.GetCurrentClassLogger().Info("Signaling Event Shutdown {0}", InputType);
+            LogManager.GetCurrentClassLogger().Info("{0}: Signalling Event Shutdown {1}", Thread.CurrentThread.ManagedThreadId, InputType);
             FinishedEvent.Set();
-            LogManager.GetCurrentClassLogger().Info("Finished signaling Shutdown {0}", InputType);
+            LogManager.GetCurrentClassLogger().Info("{0}: Finished signalling Shutdown {1}", Thread.CurrentThread.ManagedThreadId, InputType);
         }
+
         public virtual void Shutdown()
         {
-            LogManager.GetCurrentClassLogger().Info("Shutting Down {0}", InputType);
+            LogManager.GetCurrentClassLogger().Info("{0}: Shutting Down {1}", Thread.CurrentThread.ManagedThreadId, InputType);
 
             FinishedEvent.WaitOne();
-
-            LogManager.GetCurrentClassLogger().Info("Finished Wait For {0}", InputType);
+          
             try
             {
                 if (File.Exists(CheckpointFileName))
@@ -80,7 +97,33 @@ namespace TimberWinR.Inputs
             }          
         }
 
-        protected virtual void AddDefaultFields(JObject json)
+        protected void EnsureRollingCaught()
+        {
+            try
+            {
+                const string mteKey = @"SYSTEM\CurrentControlSet\Control\FileSystem";
+
+                var mte = Microsoft.Win32.Registry.LocalMachine.OpenSubKey(mteKey).GetValue("MaximumTunnelEntries");
+                if (mte == null || (int)mte != 0)
+                {
+                    LogManager.GetCurrentClassLogger()
+                        .Error(
+                            "HKLM\\{0}\\MaximumTunnelEntries is not set to accurately detect log rolling, a DWORD value of 0 is required.",
+                            mteKey);
+                    Microsoft.Win32.Registry.LocalMachine.CreateSubKey(mteKey).SetValue("MaximumTunnelEntries", 0, RegistryValueKind.DWord);
+                    LogManager.GetCurrentClassLogger()
+                      .Error(
+                          "HKLM\\{0}\\MaximumTunnelEntries is now set to 0, A reboot is now required to fix this issue.  See http://support.microsoft.com/en-us/kb/172190 for details",
+                          mteKey);
+                }
+            }
+            catch (Exception ex)
+            {
+                LogManager.GetCurrentClassLogger().Error(ex);
+            }           
+        }
+
+        public virtual void AddDefaultFields(JObject json)
         {
             if (json["type"] == null)
                 json.Add(new JProperty("type", _typeName));
@@ -100,7 +143,7 @@ namespace TimberWinR.Inputs
                 json.Add(new JProperty("UtcTimestamp", utc.ToString("o")));
         }
 
-        protected void ProcessJson(JObject json)
+        public void ProcessJson(JObject json)
         {
             if (OnMessageRecieved != null)
             {

TimberWinR/Inputs/LogsFileDatabase.cs

@@ -0,0 +1,273 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+using NLog;
+using TimberWinR.Parser;
+
+
+namespace TimberWinR.Inputs
+{
+    //
+    // Maintain persistent state for Log files (to be used across restarts)
+    //
+    public class LogsFileDatabase
+    {
+        private static readonly object _locker = new object();
+        private List<LogsFileDatabaseEntry> Entries { get; set; }
+        private string DatabaseDirectory { get; set; }
+        public string DatabaseFileName
+        {
+            get { return Path.Combine(DatabaseDirectory, ".timberwinrdb"); }
+        }
+
+        public static Manager Manager { get; set; }
+
+        private static LogsFileDatabase instance;
+
+        private bool ExistingFile(string logName)
+        {
+            lock (_locker)
+            {
+                return ExistingFileTest(logName);
+            }
+        }
+       
+        //
+        // Lookup the database entry for this log file, returns null if there isnt one.
+        //
+        private LogsFileDatabaseEntry FindFile(string logName)
+        {
+            lock (_locker)
+            {
+                var existingEntry = (from e in Entries where e.FileName == logName select e).FirstOrDefault();
+                return existingEntry;
+            }
+        }
+
+        private bool ExistingFileTest(string logName)
+        {
+            var existingEntry = (from e in Entries where e.FileName == logName select e).FirstOrDefault();
+            return existingEntry != null;
+        }
+
+        private void RemoveFileEntry(string logName)
+        {
+            lock (_locker)
+            {
+                var existingEntry = (from e in Entries where e.FileName == logName select e).FirstOrDefault();
+                if (existingEntry != null)
+                {
+                    Entries.Remove(existingEntry);
+                    WriteDatabaseFileNoLock();
+                }
+            }
+        }
+
+        private LogsFileDatabaseEntry AddFileEntry(string logName)
+        {
+            var de = new LogsFileDatabaseEntry();
+            lock (_locker)
+            {
+                var fi = new FileInfo(logName);             
+                de.FileName = logName;
+                de.LogFileExists = fi.Exists;
+                de.NewFile = true;
+                de.ProcessedFile = false;
+                de.LastPosition = fi.Length;
+                de.SampleTime = DateTime.UtcNow;
+                de.CreationTimeUtc = fi.CreationTimeUtc;               
+
+                Entries.Add(de);
+                WriteDatabaseFileNoLock();
+            }
+            return de;
+        }      
+
+        public static LogsFileDatabaseEntry LookupLogFile(string logName)
+        {
+            LogsFileDatabaseEntry dbe = Instance.FindFile(logName);
+            if (dbe == null)
+                dbe = Instance.AddFileEntry(logName);
+
+            FileInfo fi = new FileInfo(logName);          
+
+            dbe.LogFileExists = fi.Exists;
+            var creationTime = fi.CreationTimeUtc;
+
+            if (dbe.LogFileExists && creationTime != dbe.CreationTimeUtc)
+                dbe.NewFile = true;           
+
+            dbe.CreationTimeUtc = creationTime;
+      
+            return dbe;
+        }
+
+        // Find all the non-existent entries and remove them.
+        private void PruneFiles()
+        {
+            lock (_locker)
+            {
+                foreach(var entry in Entries.ToList())
+                {
+                    FileInfo fi = new FileInfo(entry.FileName);
+                    if (!fi.Exists)
+                        Entries.Remove(entry);
+                }
+                WriteDatabaseFileNoLock();
+            }
+        }
+
+        public static void Update(LogsFileDatabaseEntry dbe, bool processedFile, long lastOffset)
+        {
+            dbe.ProcessedFile = processedFile;
+            dbe.LogFileExists = File.Exists(dbe.FileName);
+            Instance.UpdateEntry(dbe, lastOffset);           
+        }
+
+        public static void Roll(LogsFileDatabaseEntry dbe)
+        {
+            dbe.ProcessedFile = false;
+            dbe.LastPosition = 0;          
+            Instance.UpdateEntry(dbe, 0);
+            dbe.NewFile = true;           
+        }
+
+        private void UpdateEntry(LogsFileDatabaseEntry dbe, long lastOffset)
+        {
+            lock (_locker)
+            {
+                var fi = new FileInfo(dbe.FileName);                
+                dbe.NewFile = !fi.Exists;
+                dbe.CreationTimeUtc = fi.CreationTimeUtc;
+                dbe.SampleTime = DateTime.UtcNow;                 
+                dbe.LastPosition = lastOffset;
+              
+                WriteDatabaseFileNoLock();
+            }
+        }
+        public static LogsFileDatabase Instance
+        {
+            get
+            {
+                if (instance == null)
+                {
+                    instance = new LogsFileDatabase(Manager.LogfileDir);
+                    lock (_locker)
+                    {
+                        if (!Directory.Exists(instance.DatabaseDirectory))
+                            Directory.CreateDirectory(instance.DatabaseDirectory);
+                        // If it exists, read the current state, otherwise create an empty database.
+                        if (File.Exists(instance.DatabaseFileName))
+                            instance.ReadDatabaseNoLock();
+                        else
+                            instance.WriteDatabaseFileNoLock();
+
+                        if (instance.Entries == null)
+                            instance.Entries = new List<LogsFileDatabaseEntry>();
+
+                        instance.PruneFiles();
+                    }
+                }
+                return instance;
+            }
+        }
+
+
+        // Serialize in the Database
+        private void ReadDatabaseNoLock()
+        {
+            try
+            {
+                var serializer = new JsonSerializer();
+                if (File.Exists(DatabaseFileName))
+                    Entries =
+                        JsonConvert.DeserializeObject<List<LogsFileDatabaseEntry>>(File.ReadAllText(DatabaseFileName));
+            }
+            catch (Exception ex)
+            {
+                LogManager.GetCurrentClassLogger()
+                    .Error("Error reading database '{0}': {1}", DatabaseFileName, ex.ToString());
+                try
+                {
+                    if (File.Exists(DatabaseFileName))
+                        File.Delete(DatabaseFileName);
+                    LogManager.GetCurrentClassLogger().Info("Creating New Database '{0}'", DatabaseFileName);
+                    WriteDatabaseLock();
+                }
+                catch (Exception ex2)
+                {
+                    LogManager.GetCurrentClassLogger().Info("Error Creating New Database '{0}': {1}", DatabaseFileName, ex2.ToString());
+                }
+            }
+        }
+        private void WriteDatabaseFileNoLock()
+        {
+            try
+            {
+                File.WriteAllText(DatabaseFileName, JsonConvert.SerializeObject(instance.Entries), Encoding.UTF8);
+            }
+            catch (Exception ex)
+            {
+                LogManager.GetCurrentClassLogger()
+                    .Error("Error saving database '{0}': {1}", DatabaseFileName, ex.ToString());
+            }
+        }
+
+
+        private void ReadDatabaseLock()
+        {
+            lock (_locker)
+            {
+                ReadDatabaseNoLock();
+            }
+
+        }
+        private void WriteDatabaseLock()
+        {
+            lock (_locker)
+            {
+                WriteDatabaseFileNoLock();
+            }
+        }
+
+        private LogsFileDatabase(string databaseDirectory)
+        {
+            DatabaseDirectory = databaseDirectory;
+            Entries = new List<LogsFileDatabaseEntry>();
+        }
+
+    }
+
+
+    //
+    // Represents a log file to be tailed
+    // 
+    public class LogsFileDatabaseEntry
+    {
+        [JsonIgnore]
+        public bool NewFile { get; set; }
+        public bool ProcessedFile { get; set; }
+        public bool LogFileExists { get; set; }
+        public string FileName { get; set; }       
+        public DateTime CreationTimeUtc { get; set; }
+        public DateTime SampleTime { get; set; }
+        public long LastPosition { get; set; }
+        public long LinesProcessed
+        {
+            get { return _linesProcessed; }
+        }
+
+        private int _linesProcessed;
+        public void IncrementLineCount()
+        {
+            Interlocked.Increment(ref _linesProcessed);
+        }
+    }
+
+}

TimberWinR/Inputs/LogsListener.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.Linq;
 using System.Net.Configuration;
 using System.Runtime.InteropServices;
@@ -9,12 +10,13 @@ using System.Threading;
 using System.Threading.Tasks;
 using System.IO;
 using Interop.MSUtil;
+using Microsoft.Win32;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Linq;
 using Newtonsoft.Json.Serialization;
 
 using NLog;
-
+using TimberWinR.Codecs;
 using LogQuery = Interop.MSUtil.LogQueryClassClass;
 using TextLineInputFormat = Interop.MSUtil.COMTextLineInputContextClass;
 using LogRecordSet = Interop.MSUtil.ILogRecordset;
@@ -22,182 +24,50 @@ using TimberWinR.Parser;
 
 namespace TimberWinR.Inputs
 {
-    public class LogsFileDatabase
-    {
-        private static readonly object _locker = new object();
-        private List<LogsFileDatabaseEntry> Entries { get; set; }
-        private string DatabaseDirectory { get; set; }
-        public string DatabaseFileName
-        {
-            get { return Path.Combine(DatabaseDirectory, ".timberwinrdb"); }
-        }
-
-        public static Manager Manager { get; set; }
-
-        private static LogsFileDatabase instance;
-
-        private bool ExistingFile(string logName)
-        {
-            lock (_locker)
-            {
-                return ExistingFileTest(logName);
-            }
-        }
-
-        private bool ExistingFileTest(string logName)
-        {
-            var existingEntry = (from e in Entries where e.FileName == logName select e).FirstOrDefault();
-            return existingEntry != null;
-        }
-
-        private void RemoveFileEntry(string logName)
-        {
-            lock (_locker)
-            {
-                var existingEntry = (from e in Entries where e.FileName == logName select e).FirstOrDefault();
-                if (existingEntry != null)
-                {
-                    Entries.Remove(existingEntry);
-                    WriteDatabaseFileNoLock();
-                }
-            }
-        }
-
-        private LogsFileDatabaseEntry AddFileEntry(string logName, TextLineInputFormat fmt)
-        {
-            LogsFileDatabaseEntry de = new LogsFileDatabaseEntry();
-            lock (_locker)
-            {
-                var lq = new LogQuery();
-                FileInfo fi = new FileInfo(logName);
-                de.FileName = logName;
-                de.Size = fi.Length;
-                de.SampleTime = DateTime.UtcNow;
-                de.CreationTime = fi.CreationTimeUtc;
-                if (fi.Exists)
-                {
-                    var qcount = string.Format("SELECT max(Index) as MaxRecordNumber FROM {0}", logName);
-                    var rcount = lq.Execute(qcount, fmt);
-                    var qr = rcount.getRecord();
-                    var lrn = (Int64)qr.getValueEx("MaxRecordNumber");
-                    de.MaxRecords = lrn;
-                }
-                Entries.Add(de);
-                WriteDatabaseFileNoLock();
-            }
-            return de;
-        }
-
-        public static LogsFileDatabaseEntry AddLogFile(string logName, TextLineInputFormat fmt)
-        {
-            Instance.RemoveFileEntry(logName); // Remove if already exists, otherwise ignores.
-            return Instance.AddFileEntry(logName, fmt);
-        }
-
-        public static LogsFileDatabase Instance
-        {
-            get
-            {
-                if (instance == null)
-                {
-                    instance = new LogsFileDatabase(Manager.LogfileDir);
-                    lock (_locker)
-                    {
-                        if (!Directory.Exists(instance.DatabaseDirectory))
-                        {
-                            Directory.CreateDirectory(instance.DatabaseDirectory);
-                        }
-                        if (File.Exists(instance.DatabaseFileName))
-                            instance.ReadDatabaseNoLock();
-                        else
-                            instance.WriteDatabaseFileNoLock();
-                    }
-                }
-                return instance;
-            }
-        }
-
-        private void ReadDatabaseNoLock()
-        {
-            JsonSerializer serializer = new JsonSerializer();
-            if (File.Exists(DatabaseFileName))
-                Entries = JsonConvert.DeserializeObject<List<LogsFileDatabaseEntry>>(File.ReadAllText(DatabaseFileName));
-        }
-        private void WriteDatabaseFileNoLock()
-        {
-            File.WriteAllText(DatabaseFileName, JsonConvert.SerializeObject(instance.Entries), Encoding.UTF8);
-        }
-
-
-        private void ReadDatabaseLock()
-        {
-            lock (_locker)
-            {
-                ReadDatabaseNoLock();
-            }
-
-        }
-        private void WriteDatabaseLock()
-        {
-            lock (_locker)
-            {
-                WriteDatabaseFileNoLock();
-            }
-        }
-
-        private LogsFileDatabase(string databaseDirectory)
-        {
-            DatabaseDirectory = databaseDirectory;
-            Entries = new List<LogsFileDatabaseEntry>();
-        }
-
-    }
-
-    public class LogsFileDatabaseEntry
-    {
-        public string FileName { get; set; }
-        public Int64 MaxRecords { get; set; }
-        public DateTime CreationTime { get; set; }
-        public DateTime SampleTime { get; set; }
-        public long Size { get; set; }
-    }
-
     /// <summary>
     /// Tail a file.
     /// </summary>
     public class LogsListener : InputListener
     {
+        private object _locker = new object();
         private int _pollingIntervalInSeconds;
-        private TimberWinR.Parser.Log _arguments;
+        private TimberWinR.Parser.LogParameters _arguments;
         private long _receivedMessages;
-        private Dictionary<string, Int64> _logFileMaxRecords;
-        private Dictionary<string, DateTime> _logFileCreationTimes;
-        private Dictionary<string, DateTime> _logFileSampleTimes;
-        private Dictionary<string, long> _logFileSizes;
-        private Codec _codec;
-        private List<string> _multiline { get; set; }
-
+        private CodecArguments _codecArguments;
+        private ICodec _codec;
+      
         public bool Stop { get; set; }
+        public bool IsWildcardFilePattern { get; set; }
 
-        public LogsListener(TimberWinR.Parser.Log arguments, CancellationToken cancelToken)
+
+        public LogsListener(TimberWinR.Parser.LogParameters arguments, CancellationToken cancelToken)
             : base(cancelToken, "Win32-FileLog")
         {
             Stop = false;
+        
+            EnsureRollingCaught();
 
-            _codec = arguments.Codec;
-            _logFileMaxRecords = new Dictionary<string, Int64>();
-            _logFileCreationTimes = new Dictionary<string, DateTime>();
-            _logFileSampleTimes = new Dictionary<string, DateTime>();
-            _logFileSizes = new Dictionary<string, long>();
+             _codecArguments = arguments.CodecArguments;
+
+            _codecArguments = arguments.CodecArguments;
+            if (_codecArguments != null && _codecArguments.Type == CodecArguments.CodecType.multiline)
+                _codec = new Multiline(_codecArguments);
 
             _receivedMessages = 0;
             _arguments = arguments;
             _pollingIntervalInSeconds = arguments.Interval;
 
+            IsWildcardFilePattern = arguments.Location.Contains('*');
+
             foreach (string srcFile in _arguments.Location.Split(','))
             {
                 string file = srcFile.Trim();
-                Task.Factory.StartNew(() => FileWatcher(file));
+                string dir = Path.GetDirectoryName(file);
+                if (string.IsNullOrEmpty(dir))
+                    dir = Environment.CurrentDirectory;
+                string fileSpec = Path.Combine(dir, file);
+
+                Task.Factory.StartNew(() => FileWatcher(fileSpec));
             }
         }
 
@@ -208,9 +78,9 @@ namespace TimberWinR.Inputs
             base.Shutdown();
         }
 
+      
         public override JObject ToJson()
         {
-
             JObject json = new JObject(
                 new JProperty("log",
                     new JObject(
@@ -221,35 +91,25 @@ namespace TimberWinR.Inputs
                         new JProperty("codepage", _arguments.CodePage),
                         new JProperty("splitLongLines", _arguments.SplitLongLines),
                         new JProperty("recurse", _arguments.Recurse),
-
+                        new JProperty("filedb",
+                            new JArray(from f in Files.ToList()
+                                       select JObject.FromObject(LogsFileDatabase.LookupLogFile(f)))),
                         new JProperty("files",
-                            new JArray(from f in _logFileMaxRecords.Keys
-                                       select new JValue(f))),
-                        new JProperty("fileSampleTimes",
-                            new JArray(from f in _logFileSampleTimes.Values
-                                       select new JValue(f))),
-                        new JProperty("fileSizes",
-                            new JArray(from f in _logFileSizes.Values
-                                       select new JValue(f))),
-                        new JProperty("fileIndices",
-                            new JArray(from f in _logFileMaxRecords.Values
-                                       select new JValue(f))),
-                        new JProperty("fileCreationDates",
-                            new JArray(from f in _logFileCreationTimes.Values
+                            new JArray(from f in Files.ToList()
                                        select new JValue(f)))
                         )));
 
 
-            if (_codec != null)
+            if (_codecArguments != null)
             {
                 var cp = new JProperty("codec",
                     new JArray(
                         new JObject(
-                            new JProperty("type", _codec.Type.ToString()),
-                            new JProperty("what", _codec.What.ToString()),
-                            new JProperty("negate", _codec.Negate),
-                            new JProperty("multilineTag", _codec.MultilineTag),
-                            new JProperty("pattern", _codec.Pattern))));
+                            new JProperty("type", _codecArguments.Type.ToString()),
+                            new JProperty("what", _codecArguments.What.ToString()),
+                            new JProperty("negate", _codecArguments.Negate),
+                            new JProperty("multilineTag", _codecArguments.MultilineTag),
+                            new JProperty("pattern", _codecArguments.Pattern))));
                 json.Add(cp);
             }
 
@@ -257,78 +117,6 @@ namespace TimberWinR.Inputs
             return json;
         }
 
-        // return true to cancel codec
-        private void applyMultilineCodec(string msg)
-        {
-            if (_codec.Re == null)
-                _codec.Re = new Regex(_codec.Pattern);
-
-            Match match = _codec.Re.Match(msg);
-
-            bool isMatch = (match.Success && !_codec.Negate) || (!match.Success && _codec.Negate);
-
-            switch (_codec.What)
-            {
-                case Codec.WhatType.previous:
-                    if (isMatch)
-                    {
-                        if (_multiline == null)
-                            _multiline = new List<string>();
-
-                        _multiline.Add(msg);
-                    }
-                    else // No Match
-                    {
-                        if (_multiline != null)
-                        {
-                            string single = string.Join("\n", _multiline.ToArray());
-                            _multiline = null;
-                            JObject jo = new JObject();
-                            jo["message"] = single;
-                            jo.Add("tags", new JArray(_codec.MultilineTag));
-                            AddDefaultFields(jo);
-                            ProcessJson(jo);
-                            _receivedMessages++;
-                        }
-                        _multiline = new List<string>();
-                        _multiline.Add(msg);
-                    }
-                    break;
-                case Codec.WhatType.next:
-                    if (isMatch)
-                    {
-                        if (_multiline == null)
-                            _multiline = new List<string>();
-                        _multiline.Add(msg);
-                    }
-                    else // No match
-                    {
-                        if (_multiline != null)
-                        {
-                            _multiline.Add(msg);
-                            string single = string.Join("\n", _multiline.ToArray());
-                            _multiline = null;
-                            JObject jo = new JObject();
-                            jo["message"] = single;
-                            jo.Add("tags", new JArray(_codec.MultilineTag));
-                            AddDefaultFields(jo);
-                            ProcessJson(jo);
-                            _receivedMessages++;
-                        }
-                        else
-                        {
-                            JObject jo = new JObject();
-                            jo["message"] = msg;
-                            AddDefaultFields(jo);
-                            ProcessJson(jo);
-                            _receivedMessages++;
-                        }
-                    }
-                    break;
-            }
-        }
-
-
         private void FileWatcher(string fileToWatch)
         {
             var iFmt = new TextLineInputFormat()
@@ -338,6 +126,8 @@ namespace TimberWinR.Inputs
                 recurse = _arguments.Recurse
             };
 
+            Dictionary<string, string> _fnfmap = new Dictionary<string, string>();
+
             using (var syncHandle = new ManualResetEventSlim())
             {
                 // Execute the query
@@ -354,46 +144,34 @@ namespace TimberWinR.Inputs
                             {
                                 var record = rsfiles.getRecord();
                                 string logName = record.getValue("LogFilename") as string;
-                                FileInfo fi = new FileInfo(logName);
+                                FileInfo fi = new FileInfo(logName);                             
 
-                                if (!fi.Exists)
-                                {
-                                    _logFileCreationTimes.Remove(logName);
-                                    _logFileMaxRecords.Remove(logName);
-                                    _logFileSizes.Remove(logName);
-                                }
-
-                                _logFileSampleTimes[logName] = DateTime.UtcNow;
+                                var dbe = LogsFileDatabase.LookupLogFile(logName);
+                    
+                                SaveVisitedFileName(dbe.FileName);
 
                                 DateTime creationTime = fi.CreationTimeUtc;
-                                bool logHasRolled = (_logFileCreationTimes.ContainsKey(logName) &&
-                                                     creationTime > _logFileCreationTimes[logName]) ||
-                                                    (_logFileSizes.ContainsKey(logName) &&
-                                                     fi.Length < _logFileSizes[logName]);
+                                bool logHasRolled = dbe.NewFile || (creationTime != dbe.CreationTimeUtc || fi.Length < dbe.LastPosition);
 
-
-                                if (!_logFileMaxRecords.ContainsKey(logName) || logHasRolled)
+                                if (logHasRolled)
                                 {
-                                    _logFileCreationTimes[logName] = creationTime;
-                                    _logFileSizes[logName] = fi.Length;
-                                    var qcount = string.Format("SELECT max(Index) as MaxRecordNumber FROM {0}", logName);
-                                    var rcount = oLogQuery.Execute(qcount, iFmt);
-                                    var qr = rcount.getRecord();
-                                    var lrn = (Int64)qr.getValueEx("MaxRecordNumber");
-                                    if (logHasRolled)
-                                    {
-                                        LogManager.GetCurrentClassLogger().Info("Log {0} has rolled", logName);
-                                        lrn = 0;
-                                    }
-                                    _logFileMaxRecords[logName] = lrn;
+                                    LogManager.GetCurrentClassLogger().Info("Log {0} has rolled", logName);
+                                    LogsFileDatabase.Roll(dbe);
                                 }
 
-                                _logFileSizes[logName] = fi.Length;
+                                // Log has rolled or this is a new file, or we haven't processed yet.
+                                bool processWholeFile = logHasRolled || !dbe.ProcessedFile;
+
+                                if (processWholeFile)
+                                    LogsFileDatabase.Update(dbe, true, 0);
+
                             }
                             rsfiles.close();
-                            foreach (string fileName in _logFileMaxRecords.Keys.ToList())
+                            foreach (string fileName in Files.ToList())
                             {
-                                var lastRecordNumber = _logFileMaxRecords[fileName];
+                                var dbe = LogsFileDatabase.LookupLogFile(fileName);
+
+                                var lastRecordNumber = dbe.LastPosition;
                                 var query = string.Format("SELECT * FROM {0} where Index > {1}", fileName,
                                     lastRecordNumber);
 
@@ -436,17 +214,22 @@ namespace TimberWinR.Inputs
                                     string msg = json["Text"].ToString();
                                     if (!string.IsNullOrEmpty(msg))
                                     {
-                                        if (_codec != null && _codec.Type == Codec.CodecType.multiline)
-                                            applyMultilineCodec(msg);
+                                        if (_codecArguments != null && _codecArguments.Type == CodecArguments.CodecType.multiline)
+                                        {
+                                            _codec.Apply(msg, this);
+                                            _receivedMessages++;
+                                            dbe.IncrementLineCount();
+                                        }
                                         else
                                         {
                                             ProcessJson(json);
-                                            _receivedMessages++;
+                                            dbe.IncrementLineCount();
+                                             _receivedMessages++;
                                         }
                                     }
 
                                     var lrn = (Int64)record.getValueEx("Index");
-                                    _logFileMaxRecords[fileName] = lrn;
+                                    LogsFileDatabase.Update(dbe, true, lrn);
                                     GC.Collect();
                                 }
 
@@ -455,16 +238,20 @@ namespace TimberWinR.Inputs
                                 rs.close();
                                 rs = null;
                                 GC.Collect();
+
                             }
-                            // Sleep 
-                            if (!Stop)
-                                syncHandle.Wait(TimeSpan.FromSeconds(_pollingIntervalInSeconds), CancelToken);
                         }
                         catch (FileNotFoundException fnfex)
                         {
-                            LogManager.GetCurrentClassLogger().Warn(fnfex.Message);
+                            string fn = fnfex.FileName;
+
+                            if (!string.IsNullOrEmpty(fn) && !_fnfmap.ContainsKey(fn))
+                            {
+                                LogManager.GetCurrentClassLogger().Warn(fnfex.Message);
+                                _fnfmap[fn] = fn;
+                            }
                         }
-                        catch (OperationCanceledException oce)
+                        catch (OperationCanceledException)
                         {
                             break;
                         }
@@ -474,7 +261,20 @@ namespace TimberWinR.Inputs
                         }
                         finally
                         {
-                            oLogQuery = null;
+                            try
+                            {
+                                oLogQuery = null;
+                                // Sleep 
+                                if (!Stop)
+                                    syncHandle.Wait(TimeSpan.FromSeconds(_pollingIntervalInSeconds), CancelToken);
+                            }
+                            catch (OperationCanceledException)
+                            {
+                            }
+                            catch (Exception ex1)
+                            {
+                                LogManager.GetCurrentClassLogger().Warn(ex1);
+                            }
                         }
                     }
                 }

TimberWinR/Inputs/StdinListener.cs

@@ -2,26 +2,36 @@
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.Linq;
+using System.Runtime.InteropServices;
 using System.Text;
 using System.Text.RegularExpressions;
 using System.Threading;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Linq;
 using NLog;
+using TimberWinR.Codecs;
 using TimberWinR.Parser;
 
 namespace TimberWinR.Inputs
 {
     public class StdinListener : InputListener
     {
+        [DllImport("User32.Dll", EntryPoint = "PostMessageA")]
+        private static extern bool PostMessage(IntPtr hWnd, uint msg, int wParam, int lParam);
+  
         private Thread _listenThread;
-        private Codec _codec;
-        private List<string> _multiline { get; set; }
+        private CodecArguments _codecArguments;
+        private ICodec _codec;
+        const int VK_RETURN = 0x0D;
+        const int WM_KEYDOWN = 0x100;
 
         public StdinListener(TimberWinR.Parser.Stdin arguments, CancellationToken cancelToken)
             : base(cancelToken, "Win32-Console")
         {
-            _codec = arguments.Codec;
+            _codecArguments = arguments.CodecArguments;
+            if (_codecArguments != null && _codecArguments.Type == CodecArguments.CodecType.multiline)
+                _codec = new Multiline(_codecArguments);
+
             _listenThread = new Thread(new ThreadStart(ListenToStdin));
             _listenThread.Start();
         }
@@ -32,16 +42,16 @@ namespace TimberWinR.Inputs
                 new JProperty("stdin", "enabled"));
 
             
-            if (_codec != null)
+            if (_codecArguments != null)
             {
                 var cp = new JProperty("codec",
                     new JArray(
                         new JObject(
-                            new JProperty("type", _codec.Type.ToString()),
-                            new JProperty("what", _codec.What.ToString()),
-                            new JProperty("negate", _codec.Negate),
-                            new JProperty("multilineTag", _codec.MultilineTag),
-                            new JProperty("pattern", _codec.Pattern))));
+                            new JProperty("type", _codecArguments.Type.ToString()),
+                            new JProperty("what", _codecArguments.What.ToString()),
+                            new JProperty("negate", _codecArguments.Negate),
+                            new JProperty("multilineTag", _codecArguments.MultilineTag),
+                            new JProperty("pattern", _codecArguments.Pattern))));
                 json.Add(cp);              
             }
 
@@ -50,7 +60,14 @@ namespace TimberWinR.Inputs
 
         public override void Shutdown()
         {
-            LogManager.GetCurrentClassLogger().Info("Shutting Down {0}", InputType);
+            LogManager.GetCurrentClassLogger().Info("Shutting Down {0}", InputType);    
+            // This must come from another thread.
+            ThreadPool.QueueUserWorkItem((o) =>
+            {
+                Thread.Sleep(100);
+                var hWnd = System.Diagnostics.Process.GetCurrentProcess().MainWindowHandle;
+                PostMessage(hWnd, WM_KEYDOWN, VK_RETURN, 0);
+            });
             base.Shutdown();
         }
 
@@ -65,8 +82,8 @@ namespace TimberWinR.Inputs
                 {
                     string msg = ToPrintable(line);
 
-                    if (_codec != null && _codec.Type == Codec.CodecType.multiline)
-                        applyMultilineCodec(msg);
+                    if (_codecArguments != null && _codecArguments.Type == CodecArguments.CodecType.multiline)                   
+                        _codec.Apply(msg, this);                   
                     else
                     {
                         JObject jo = new JObject();
@@ -78,73 +95,5 @@ namespace TimberWinR.Inputs
             }
             Finished();
         }
-
-        // return true to cancel codec
-        private void applyMultilineCodec(string msg)
-        {
-            if (_codec.Re == null)
-                _codec.Re = new Regex(_codec.Pattern);
-
-            Match match = _codec.Re.Match(msg);
-
-            bool isMatch = (match.Success && !_codec.Negate) || (!match.Success && _codec.Negate);
-
-            switch (_codec.What)
-            {
-                case Codec.WhatType.previous:
-                    if (isMatch)
-                    {
-                        if (_multiline == null)
-                            _multiline = new List<string>();
-
-                        _multiline.Add(msg);
-                    }
-                    else // No Match
-                    {
-                        if (_multiline != null)
-                        {
-                            string single = string.Join("\n", _multiline.ToArray());
-                            _multiline = null;
-                            JObject jo = new JObject();
-                            jo["message"] = single;
-                            jo.Add("tags", new JArray(_codec.MultilineTag));
-                            AddDefaultFields(jo);
-                            ProcessJson(jo);                          
-                        }
-                        _multiline = new List<string>();
-                        _multiline.Add(msg);
-                    }
-                    break;
-                case Codec.WhatType.next:
-                    if (isMatch)
-                    {
-                        if (_multiline == null)
-                            _multiline = new List<string>();
-                        _multiline.Add(msg);
-                    }
-                    else // No match
-                    {
-                        if (_multiline != null)
-                        {
-                            _multiline.Add(msg);
-                            string single = string.Join("\n", _multiline.ToArray());
-                            _multiline = null;
-                            JObject jo = new JObject();
-                            jo["message"] = single;
-                            jo.Add("tags", new JArray(_codec.MultilineTag));
-                            AddDefaultFields(jo);
-                            ProcessJson(jo);                          
-                        }
-                        else
-                        {
-                            JObject jo = new JObject();
-                            jo["message"] = msg;
-                            AddDefaultFields(jo);
-                            ProcessJson(jo);                          
-                        }
-                    }
-                    break;
-            }
-        }
     }
 }

TimberWinR/Inputs/TailFileListener.cs

@@ -0,0 +1,279 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Net.Configuration;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using System.IO;
+using Interop.MSUtil;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+using Newtonsoft.Json.Serialization;
+
+using NLog;
+using NLog.LayoutRenderers;
+using TimberWinR.Codecs;
+using TimberWinR.Parser;
+
+namespace TimberWinR.Inputs
+{
+    /// <summary>
+    /// Tail a file.
+    /// </summary>
+    public class TailFileListener : InputListener
+    {
+        private object _locker = new object();
+        private int _pollingIntervalInSeconds;
+        private TimberWinR.Parser.TailFileArguments _arguments;
+        private long _receivedMessages;
+
+        private CodecArguments _codecArguments;
+        private ICodec _codec;
+       
+        public bool Stop { get; set; }
+
+        public TailFileListener(TimberWinR.Parser.TailFileArguments arguments, CancellationToken cancelToken)
+            : base(cancelToken, "Win32-TailLog")
+        {
+            Stop = false;
+         
+            EnsureRollingCaught();    
+
+            _codecArguments = arguments.CodecArguments;
+            if (_codecArguments != null && _codecArguments.Type == CodecArguments.CodecType.multiline)
+                _codec = new Multiline(_codecArguments);
+
+            _receivedMessages = 0;
+            _arguments = arguments;
+            _pollingIntervalInSeconds = arguments.Interval;
+
+            foreach (string srcFile in _arguments.Location.Split(','))
+            {
+                string file = srcFile.Trim();
+                Task.Factory.StartNew(() => TailFileWatcher(file));
+            }
+        }
+
+        public override void Shutdown()
+        {
+            LogManager.GetCurrentClassLogger().Info("{0}: Shutting Down {1} for {2}", Thread.CurrentThread.ManagedThreadId, InputType, _arguments.Location);
+            Stop = true;
+            base.Shutdown();
+        }
+
+        public override JObject ToJson()
+        {
+            JObject json = new JObject(
+                new JProperty("taillog",
+                    new JObject(
+                        new JProperty("messages", _receivedMessages),
+                        new JProperty("type", InputType),
+                        new JProperty("location", _arguments.Location),
+                        new JProperty("logSource", _arguments.LogSource),
+                        new JProperty("recurse", _arguments.Recurse),
+                        new JProperty("files",
+                            new JArray(from f in Files
+                                       select new JValue(f))),
+                        new JProperty("filedb",
+                            new JArray(from f in Files
+                                       select JObject.FromObject(LogsFileDatabase.LookupLogFile(f))))
+                        )));
+
+
+            if (_codecArguments != null)
+            {
+                var cp = new JProperty("codec",
+                    new JArray(
+                        new JObject(
+                            new JProperty("type", _codecArguments.Type.ToString()),
+                            new JProperty("what", _codecArguments.What.ToString()),
+                            new JProperty("negate", _codecArguments.Negate),
+                            new JProperty("multilineTag", _codecArguments.MultilineTag),
+                            new JProperty("pattern", _codecArguments.Pattern))));
+                json.Add(cp);
+            }
+
+
+            return json;
+        }
+
+        private void TailFileContents(string fileName, long offset, LogsFileDatabaseEntry dbe)
+        {
+            using (StreamReader reader = new StreamReader(new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.ReadWrite)))
+            {
+                //start at the end of the file
+                long lastMaxOffset = offset;
+
+                //if the file size has not changed, idle
+                if (reader.BaseStream.Length == lastMaxOffset)
+                    return;
+
+                //seek to the last max offset
+                LogManager.GetCurrentClassLogger().Trace("{0}: File: {1} Seek to: {2}", Thread.CurrentThread.ManagedThreadId, fileName, lastMaxOffset);
+
+                reader.BaseStream.Seek(lastMaxOffset, SeekOrigin.Begin);
+
+                //read out of the file until the EOF
+                string line = "";
+                long lineOffset = 0;
+                while ((line = reader.ReadLine()) != null)
+                {
+                    if (string.IsNullOrEmpty(line))
+                        continue;
+
+                    long index = lastMaxOffset + lineOffset;
+                    string text = line;
+                    string logFileName = fileName;
+                    var json = new JObject();
+
+                    if (json["logSource"] == null)
+                    {
+                        if (string.IsNullOrEmpty(_arguments.LogSource))
+                            json.Add(new JProperty("logSource", fileName));
+                        else
+                            json.Add(new JProperty("logSource", _arguments.LogSource));
+                    }
+
+                    json["Text"] = line;
+                    json["Index"] = index;
+                    json["LogFileName"] = fileName;
+
+
+                    if (_codecArguments != null && _codecArguments.Type == CodecArguments.CodecType.multiline)
+                    {
+                        _codec.Apply(line, this);
+                        Interlocked.Increment(ref _receivedMessages);
+                        dbe.IncrementLineCount();
+                    }
+                    else
+                    {
+                        ProcessJson(json);
+                        Interlocked.Increment(ref _receivedMessages);
+                        dbe.IncrementLineCount();
+                        //LogManager.GetCurrentClassLogger().Info("{0}: File: {1} {2} {3}", Thread.CurrentThread.ManagedThreadId, fileName, dbe.LinesProcessed, line);
+                    }                 
+
+                    lineOffset += line.Length;
+                }
+                //update the last max offset
+                lastMaxOffset = reader.BaseStream.Position;
+                LogsFileDatabase.Update(dbe, true, lastMaxOffset);               
+            }
+        }
+        // One thread for each kind of file to watch, i.e. "*.log,*.txt" would be two separate
+        // threads.
+        private void TailFileWatcher(string fileToWatch)
+        {
+            Dictionary<string, string> _fnfmap = new Dictionary<string, string>();
+
+            using (var syncHandle = new ManualResetEventSlim())
+            {
+                // Execute the query
+                while (!Stop && !CancelToken.IsCancellationRequested)
+                {
+                    try
+                    {
+                        if (!CancelToken.IsCancellationRequested)
+                        {
+                            var isWildcardPattern = fileToWatch.Contains('*');
+                            string path = Path.GetDirectoryName(fileToWatch);
+                            string name = Path.GetFileName(fileToWatch);
+                            if (string.IsNullOrEmpty(path))
+                                path = ".";
+
+                            LogManager.GetCurrentClassLogger().Trace(":{0} Tailing File: {1}", Thread.CurrentThread.ManagedThreadId, Path.Combine(path, name));
+
+                            // Ok, we have a potential file filter here as 'fileToWatch' could be foo.log or *.log
+
+                            SearchOption so = SearchOption.TopDirectoryOnly;
+                            if (_arguments.Recurse == -1)
+                                so = SearchOption.AllDirectories;
+
+                            foreach (string fileName in Directory.GetFiles(path, name, so))
+                            {
+                                var dbe = LogsFileDatabase.LookupLogFile(fileName);
+
+                                // We only spin up 1 thread for a file we haven't yet seen.                               
+                                if (isWildcardPattern && !HaveSeenFile(fileName) && dbe.NewFile)
+                                {
+                                    LogManager.GetCurrentClassLogger().Debug(":{0} Starting Thread Tailing File: {1}", Thread.CurrentThread.ManagedThreadId, dbe.FileName);
+                                    LogsFileDatabase.Update(dbe, false, dbe.LastPosition);
+                                    SaveVisitedFileName(fileName);
+                                    Task.Factory.StartNew(() => TailFileWatcher(fileName));
+                                }
+                                else if (!isWildcardPattern)
+                                {
+                                    FileInfo fi = new FileInfo(dbe.FileName);
+
+                                    //LogManager.GetCurrentClassLogger().Info("Located File: {0}, New: {1}", dbe.FileName, dbe.NewFile);                                
+                                    long length = fi.Length;
+                                    bool logHasRolled = false;
+                                    if (fi.Length < dbe.LastPosition || fi.CreationTimeUtc != dbe.CreationTimeUtc)
+                                    {
+                                        LogManager.GetCurrentClassLogger().Info("{0}: Log has Rolled: {1}", Thread.CurrentThread.ManagedThreadId, dbe.FileName);
+                                        logHasRolled = true;
+                                        LogsFileDatabase.Roll(dbe);
+                                    }
+                                    // Log has rolled or this is a file we are seeing for the first time.
+                                    bool processWholeFile = logHasRolled || !dbe.ProcessedFile;
+                                    if (processWholeFile)
+                                    {
+                                        LogsFileDatabase.Update(dbe, true, 0);
+                                        LogManager.GetCurrentClassLogger().Debug("{0}: Process Whole File: {1}", Thread.CurrentThread.ManagedThreadId, dbe.FileName);
+                                        TailFileContents(dbe.FileName, 0, dbe);
+                                    }
+                                    else
+                                    {
+                                        TailFileContents(dbe.FileName, dbe.LastPosition, dbe);
+                                    }                                  
+                                }
+                            }
+                        }
+                    }
+                    catch (FileNotFoundException fnfex)
+                    {
+                        string fn = fnfex.FileName;
+
+                        if (!_fnfmap.ContainsKey(fn))
+                            LogManager.GetCurrentClassLogger().Warn(fnfex.Message);
+                        _fnfmap[fn] = fn;
+                    }
+                    catch (IOException ioex)
+                    {
+                        LogManager.GetCurrentClassLogger().Debug("Log has rolled: {0}", ioex.Message);
+                    }
+                    catch (OperationCanceledException)
+                    {
+                        break;
+                    }
+                    catch (Exception ex)
+                    {
+                        LogManager.GetCurrentClassLogger().Error(ex);
+                    }
+                    finally
+                    {
+                        try
+                        {
+                            if (!Stop)
+                                syncHandle.Wait(TimeSpan.FromSeconds(_pollingIntervalInSeconds), CancelToken);
+                        }
+                        catch (OperationCanceledException)
+                        {
+                            Stop = true;
+                        }
+                        catch (Exception ex1)
+                        {
+                            LogManager.GetCurrentClassLogger().Warn(ex1);
+                        }
+                    }
+                }
+            }
+            Finished();
+        }       
+    }
+}
+

TimberWinR/Inputs/TcpInputListener.cs

@@ -16,7 +16,9 @@ namespace TimberWinR.Inputs
         private Thread _listenThreadV4;
         private Thread _listenThreadV6;
         private readonly int _port;
+       
         private long _receivedMessages;
+        private long _errorCount;
 
         public override JObject ToJson()
         {
@@ -24,9 +26,9 @@ namespace TimberWinR.Inputs
                 new JProperty("tcp",
                     new JObject(
                         new JProperty("port", _port),
+                        new JProperty("errors", _errorCount),
                         new JProperty("messages", _receivedMessages)
                         )));
-
             return json;
         }
 
@@ -52,7 +54,7 @@ namespace TimberWinR.Inputs
 
         public override void Shutdown()
         {
-            LogManager.GetCurrentClassLogger().Info("Shutting Down {0}", InputType);
+            LogManager.GetCurrentClassLogger().Info("{0}: Shutting Down {1}", Thread.CurrentThread.ManagedThreadId, InputType);
 
             this._tcpListenerV4.Stop();
             this._tcpListenerV6.Stop();
@@ -68,7 +70,6 @@ namespace TimberWinR.Inputs
 
             listener.Start();
 
-
             while (!CancelToken.IsCancellationRequested)
             {
                 try
@@ -79,7 +80,7 @@ namespace TimberWinR.Inputs
                     // Wait for a client, spin up a thread.
                     var clientThread = new Thread(new ParameterizedThreadStart(HandleNewClient));
                     clientThread.Start(client);
-                }
+                }                
                 catch (SocketException ex)
                 {
                     if (ex.SocketErrorCode == SocketError.Interrupted)
@@ -109,17 +110,25 @@ namespace TimberWinR.Inputs
                             {
                                 JObject json = JObject.Load(reader);
                                 ProcessJson(json);
-                                _receivedMessages++;
+                                Interlocked.Increment(ref _receivedMessages);
                             }
                             catch (Exception ex)
                             {
+                                var jex1 = LogErrors.LogException("Bad Json", ex);
+                                if (jex1 != null)
+                                    ProcessJson(jex1);
+
                                 LogManager.GetCurrentClassLogger().Warn(ex);
+                                Interlocked.Increment(ref _errorCount);
                             }
 
                         }
                     }
                 }
             }
+            catch(OperationCanceledException)
+            {
+            }
             catch (Exception ex)
             {
                 LogManager.GetCurrentClassLogger().Error(ex);

TimberWinR/Inputs/UdpInputListener.cs

@@ -1,6 +1,7 @@
 using System;
 using System.IO;
 using System.Text;
+using System.Text.RegularExpressions;
 using System.Threading;
 using System.Net;
 using System.Net.Sockets;
@@ -11,29 +12,21 @@ using NLog;
 namespace TimberWinR.Inputs
 {
     public class UdpInputListener : InputListener
-    {
-        private readonly System.Net.Sockets.UdpClient _udpListener;
-        private IPEndPoint groupV4;
-        private IPEndPoint groupV6;
-
-        private Thread _listenThreadV4;
-        private Thread _listenThreadV6;
+    {      
+        private UdpClient _udpListenerV4;      
+        private readonly Thread _listenThreadV4;
 
         private readonly int _port;
         private long _receivedMessages;
-
-        private struct listenProfile
-        {
-            public IPEndPoint endPoint;
-            public UdpClient client;
-        }
-
+        private long _parsedErrors;
+       
         public override JObject ToJson()
         {
             JObject json = new JObject(
                 new JProperty("udp",
                     new JObject(
                         new JProperty("port", _port),
+                        new JProperty("errors", _parsedErrors),
                         new JProperty("messages", _receivedMessages)
                         )));
 
@@ -43,53 +36,71 @@ namespace TimberWinR.Inputs
         public UdpInputListener(CancellationToken cancelToken, int port = 5140)
             : base(cancelToken, "Win32-Udp")
         {
-            _port = port;
-
-            LogManager.GetCurrentClassLogger().Info("Udp Input on Port {0} Ready", _port);
-
+            _port = port;     
             _receivedMessages = 0;
 
-            _udpListener = new System.Net.Sockets.UdpClient(port);
-
-            _listenThreadV4 = new Thread(new ParameterizedThreadStart(StartListener));
-            _listenThreadV4.Start(new listenProfile() { endPoint = groupV4, client = _udpListener });
-
-            _listenThreadV6 = new Thread(new ParameterizedThreadStart(StartListener));
-            _listenThreadV6.Start(new listenProfile() { endPoint = groupV6, client = _udpListener });
+            _listenThreadV4 = new Thread(StartListener);
+            _listenThreadV4.Start();
         }
 
 
         public override void Shutdown()
         {
             LogManager.GetCurrentClassLogger().Info("Shutting Down {0}", InputType);
-            _udpListener.Close();
-            Finished();
+
+            // close UDP listeners, which will end the listener threads          
+            _udpListenerV4.Close();
+
+            // wait for completion of the threads         
+            _listenThreadV4.Join();          
+
             base.Shutdown();
         }
 
+        private void StartListener()
+        {                      
+            var groupV4 = new IPEndPoint(IPAddress.Any, _port);
 
-        private void StartListener(object useProfile)
-        {
-            var profile = (listenProfile)useProfile;
+            _udpListenerV4 = new UdpClient(_port);            
+    
+            LogManager.GetCurrentClassLogger().Info("Udp Input on Port {0} Ready", groupV4);
 
+            string lastMessage = "";
             try
             {
                 while (!CancelToken.IsCancellationRequested)
                 {
-                    byte[] bytes = profile.client.Receive(ref profile.endPoint);
                     try
                     {
-                        var data = Encoding.ASCII.GetString(bytes, 0, bytes.Length);
-                        JObject json = JObject.Parse(data);
+                        byte[] bytes = _udpListenerV4.Receive(ref groupV4);  
+                        var data = Encoding.UTF8.GetString(bytes, 0, bytes.Length);                                                
+                        lastMessage = data;
+                        var json = JObject.Parse(data);
                         ProcessJson(json);
-                        _receivedMessages++;
+                        Interlocked.Increment(ref _receivedMessages);                       
                     }
-                    catch (Exception ex1)
+                    catch(ArgumentException aex)
                     {
-                        LogManager.GetCurrentClassLogger().Warn(ex1);
+                        LogManager.GetCurrentClassLogger().Error(aex);
+                        break;
+                    }
+                    catch(SocketException)
+                    {                       
+                        break;
+                    }
+                    catch (Exception ex)
+                    {                      
+                        var jex1 = LogErrors.LogException(string.Format("Invalid JSON: {0}", lastMessage), ex);
+                        if (jex1 != null)
+                            ProcessJson(jex1);
+      
+                        LogManager.GetCurrentClassLogger().Warn("Bad JSON: {0}", lastMessage);
+                        LogManager.GetCurrentClassLogger().Warn(ex);
+
+                        Interlocked.Increment(ref _parsedErrors);
                     }
                 }
-                _udpListener.Close();
+                _udpListenerV4.Close();
             }
             catch (Exception ex)
             {

TimberWinR/Inputs/W3CInputListener.cs

@@ -23,11 +23,11 @@ namespace TimberWinR.Inputs
     public class W3CInputListener : InputListener
     {
         private readonly int _pollingIntervalInSeconds;
-        private readonly TimberWinR.Parser.W3CLog _arguments;
+        private readonly TimberWinR.Parser.W3CLogParameters _arguments;
         private long _receivedMessages;
         public bool Stop { get; set; }
 
-        public W3CInputListener(TimberWinR.Parser.W3CLog arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 5)
+        public W3CInputListener(TimberWinR.Parser.W3CLogParameters arguments, CancellationToken cancelToken, int pollingIntervalInSeconds = 5)
             : base(cancelToken, "Win32-W3CLog")
         {
             _arguments = arguments;
@@ -153,7 +153,7 @@ namespace TimberWinR.Inputs
                             if (!Stop)
                                 syncHandle.Wait(TimeSpan.FromSeconds(_pollingIntervalInSeconds), CancelToken);
                         }
-                        catch (OperationCanceledException oce)
+                        catch (OperationCanceledException)
                         {
                             break;
                         }

TimberWinR/Inputs/WindowsEvtInputListener.cs

@@ -1,17 +1,10 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
-using System.Runtime.InteropServices;
-using System.Security.AccessControl;
-using System.Text;
 using System.Threading;
-using System.Threading.Tasks;
-using System.IO;
-using Interop.MSUtil;
-
 using Newtonsoft.Json.Linq;
-using Newtonsoft.Json.Serialization;
 using NLog;
+using TimberWinR.Parser;
 using LogQuery = Interop.MSUtil.LogQueryClassClass;
 using EventLogInputFormat = Interop.MSUtil.COMEventLogInputContextClassClass;
 using LogRecordSet = Interop.MSUtil.ILogRecordset;
@@ -23,13 +16,13 @@ namespace TimberWinR.Inputs
     /// </summary>
     public class WindowsEvtInputListener : InputListener
     {
-        private int _pollingIntervalInSeconds = 1;
-        private TimberWinR.Parser.WindowsEvent _arguments;
+        private readonly int _pollingIntervalInSeconds = 1;
+        private readonly WindowsEvent _arguments;
         private long _receivedMessages;
-        private List<Thread> _tasks { get; set; }
+        private readonly List<Thread> _tasks;
         public bool Stop { get; set; }
 
-        public WindowsEvtInputListener(TimberWinR.Parser.WindowsEvent arguments, CancellationToken cancelToken)
+        public WindowsEvtInputListener(WindowsEvent arguments, CancellationToken cancelToken)
             : base(cancelToken, "Win32-Eventlog")
         {
             _arguments = arguments;
@@ -38,8 +31,7 @@ namespace TimberWinR.Inputs
 
             foreach (string eventHive in _arguments.Source.Split(','))
             {
-                string hive = eventHive.Trim();
-                var thread = new Thread(new ParameterizedThreadStart(EventWatcher));
+                var thread = new Thread(EventWatcher) {Name = "Win32-Eventlog-" + eventHive};
                 _tasks.Add(thread);
                 thread.Start(eventHive);
             }
@@ -48,7 +40,11 @@ namespace TimberWinR.Inputs
         public override void Shutdown()
         {
             Stop = true;
-            LogManager.GetCurrentClassLogger().Info("Shutting Down {0}", InputType);           
+            LogManager.GetCurrentClassLogger().Info("Shutting Down {0}", InputType);
+            foreach (var thread in _tasks)
+            {
+                thread.Join();
+            }
             base.Shutdown();
         }
 
@@ -76,8 +72,6 @@ namespace TimberWinR.Inputs
         {
             string location = ploc.ToString();
 
-            LogQuery oLogQuery = new LogQuery();
-
             LogManager.GetCurrentClassLogger().Info("WindowsEvent Input Listener Ready");
 
             // Instantiate the Event Log Input Format object
@@ -93,9 +87,7 @@ namespace TimberWinR.Inputs
                 resolveSIDs = _arguments.ResolveSIDS
             };
 
-            oLogQuery = null;
-
-            Dictionary<string, Int64> logFileMaxRecords = new Dictionary<string, Int64>();
+            var logFileMaxRecords = new Dictionary<string, Int64>();
 
             using (var syncHandle = new ManualResetEventSlim())
             {
@@ -107,7 +99,7 @@ namespace TimberWinR.Inputs
                     {
                         try
                         {                          
-                            oLogQuery = new LogQuery();
+                            var oLogQuery = new LogQuery();
 
                             var qfiles = string.Format("SELECT Distinct [EventLog] FROM {0}", location);
                             var rsfiles = oLogQuery.Execute(qfiles, iFmt);
@@ -145,27 +137,25 @@ namespace TimberWinR.Inputs
                                         object v = record.getValue(field.Name);
                                         if (field.Name == "Data")
                                             v = ToPrintable(v.ToString());
+                                        if ((field.Name == "TimeGenerated" || field.Name == "TimeWritten") && field.DataType == typeof (DateTime))
+                                            v = ((DateTime) v).ToUniversalTime();
                                         json.Add(new JProperty(field.Name, v));
                                     }
 
                                     var lrn = (Int64)record.getValueEx("RecordNumber");
                                     logFileMaxRecords[fileName] = lrn;
 
-                                    record = null;
                                     ProcessJson(json);
                                     _receivedMessages++;
-                                    json = null;
-
                                 }
                                 // Close the recordset
                                 rs.close();
-                                rs = null;
                                 GC.Collect();
                             }
                             if (!Stop)
                                 syncHandle.Wait(TimeSpan.FromSeconds(_pollingIntervalInSeconds), CancelToken);
                         }
-                        catch (OperationCanceledException oce)
+                        catch (OperationCanceledException)
                         {
                             break;
                         }

TimberWinR/LogErrors.cs

@@ -0,0 +1,48 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+using Newtonsoft.Json.Serialization;
+using TimberWinR.Parser;
+
+namespace TimberWinR
+{
+    public class LogErrors
+    {
+        public static JObject LogException(Exception ex)
+        {
+            return LogException("Exception", ex);
+        }
+
+        public static JObject LogException(string errorMessage, Exception ex)
+        {
+            JObject result = new JObject();
+            result["type"] = "TimberWinR-Error";
+            result["ErrorMessage"] = errorMessage;
+            
+            try
+            {  
+                JsonConvert.DefaultSettings = () => new JsonSerializerSettings
+                {
+                    Formatting = Formatting.Indented,
+                    NullValueHandling = NullValueHandling.Ignore
+                };
+
+                var exJson = JObject.Parse(JsonConvert.SerializeObject(ex));
+
+                result.Merge(exJson, new JsonMergeSettings
+                {
+                    MergeArrayHandling = MergeArrayHandling.Replace
+                });
+                return result;
+            }
+            catch (Exception ex1)
+            {
+                result["ErrorMessage"] = ex1.ToString();
+                return result;
+            }           
+        }
+    }
+}

TimberWinR/Manager.cs

@@ -26,6 +26,10 @@ namespace TimberWinR
         public List<TcpInputListener> Tcps { get; set; }
         public List<TcpInputListener> Udps { get; set; }
         public List<InputListener> Listeners { get; set; }
+        public bool LiveMonitor { get; set; }
+
+        public event Action<Configuration> OnConfigurationProcessed;
+
         public DateTime StartedOn { get; set; }
         public string JsonConfig { get; set; }
         public string LogfileDir { get; set; }
@@ -60,11 +64,17 @@ namespace TimberWinR
             Interlocked.Add(ref numMessages, count);
         }
 
-        public Manager(string jsonConfigFile, string logLevel, string logfileDir, CancellationToken cancelToken)
+        public Manager()
+        {
+            LogsFileDatabase.Manager = this;                   
+        }
+
+        public Manager(string jsonConfigFile, string logLevel, string logfileDir, bool liveMonitor, CancellationToken cancelToken, bool processConfiguration = true)
         {
             LogsFileDatabase.Manager = this;           
   
             StartedOn = DateTime.UtcNow;
+            LiveMonitor = liveMonitor;
 
             var vfi = new FileInfo(jsonConfigFile);
 
@@ -98,13 +108,14 @@ namespace TimberWinR
 
             LogManager.GlobalThreshold = LogLevel.FromString(logLevel);
 
-            LogManager.GetCurrentClassLogger()
-                .Info("TimberWinR Version {0}", GetAssemblyByName("TimberWinR.ServiceHost").GetName().Version.ToString());
-
+            //LogManager.GetCurrentClassLogger()
+            //    .Info("TimberWinR Version {0}", GetAssemblyByName("TimberWinR.ServiceHost").GetName().Version.ToString());
 
             LogManager.GetCurrentClassLogger()
-                .Info("Database Directory: {0}", LogsFileDatabase.Instance.DatabaseFileName);
+                .Info("TimberWinR Version {0}", Assembly.GetEntryAssembly().GetName().Version.ToString());
 
+            LogManager.GetCurrentClassLogger()
+                .Info("Database Filename: {0}", LogsFileDatabase.Instance.DatabaseFileName);
 
             try
             {
@@ -113,7 +124,7 @@ namespace TimberWinR
                 {
                     DirectoryInfo di = new DirectoryInfo(jsonConfigFile);
                     LogManager.GetCurrentClassLogger().Info("Initialized, Reading Configurations From {0}", di.FullName);
-                    Config = Configuration.FromDirectory(jsonConfigFile);
+                    Config = Configuration.FromDirectory(jsonConfigFile, cancelToken, this);
                 }
                 else
                 {
@@ -139,36 +150,51 @@ namespace TimberWinR
             LogManager.GetCurrentClassLogger().Info("Log Directory {0}", logfileDir);
             LogManager.GetCurrentClassLogger().Info("Logging Level: {0}", LogManager.GlobalThreshold);
 
-            // Read the Configuration file
-            if (Config != null)
+            if (processConfiguration)
             {
-                if (Config.RedisOutputs != null)
+                ProcessConfiguration(cancelToken, Config);               
+            }
+        }
+
+        public void Start(CancellationToken cancelToken)
+        {
+            ProcessConfiguration(cancelToken, Config);          
+        }
+
+        public void ProcessConfiguration(CancellationToken cancelToken, Configuration config)
+        {
+// Read the Configuration file
+            if (config != null)
+            {
+                if (OnConfigurationProcessed != null)
+                    OnConfigurationProcessed(config);
+  
+                if (config.RedisOutputs != null)
                 {
-                    foreach (var ro in Config.RedisOutputs)
+                    foreach (var ro in config.RedisOutputs)
                     {
                         var redis = new RedisOutput(this, ro, cancelToken);
                         Outputs.Add(redis);
                     }
-
                 }
-                if (Config.ElasticsearchOutputs != null)
+                if (config.ElasticsearchOutputs != null)
                 {
-                    foreach (var ro in Config.ElasticsearchOutputs)
+                    foreach (var ro in config.ElasticsearchOutputs)
                     {
                         var els = new ElasticsearchOutput(this, ro, cancelToken);
                         Outputs.Add(els);
                     }
                 }
-                if (Config.StdoutOutputs != null)
+                if (config.StdoutOutputs != null)
                 {
-                    foreach (var ro in Config.StdoutOutputs)
+                    foreach (var ro in config.StdoutOutputs)
                     {
                         var stdout = new StdoutOutput(this, ro, cancelToken);
                         Outputs.Add(stdout);
                     }
                 }
 
-                foreach (Parser.IISW3CLog iisw3cConfig in Config.IISW3C)
+                foreach (Parser.IISW3CLogParameters iisw3cConfig in config.IISW3C)
                 {
                     var elistner = new IISW3CInputListener(iisw3cConfig, cancelToken);
                     Listeners.Add(elistner);
@@ -176,7 +202,7 @@ namespace TimberWinR
                         output.Connect(elistner);
                 }
 
-                foreach (Parser.W3CLog iisw3cConfig in Config.W3C)
+                foreach (Parser.W3CLogParameters iisw3cConfig in config.W3C)
                 {
                     var elistner = new W3CInputListener(iisw3cConfig, cancelToken);
                     Listeners.Add(elistner);
@@ -184,7 +210,7 @@ namespace TimberWinR
                         output.Connect(elistner);
                 }
 
-                foreach (Parser.WindowsEvent eventConfig in Config.Events)
+                foreach (Parser.WindowsEvent eventConfig in config.Events)
                 {
                     var elistner = new WindowsEvtInputListener(eventConfig, cancelToken);
                     Listeners.Add(elistner);
@@ -192,7 +218,7 @@ namespace TimberWinR
                         output.Connect(elistner);
                 }
 
-                foreach (var logConfig in Config.Logs)
+                foreach (var logConfig in config.Logs)
                 {
                     var elistner = new LogsListener(logConfig, cancelToken);
                     Listeners.Add(elistner);
@@ -200,7 +226,15 @@ namespace TimberWinR
                         output.Connect(elistner);
                 }
 
-                foreach (var tcp in Config.Tcps)
+                foreach (var logConfig in config.TailFiles)
+                {
+                    var elistner = new TailFileListener(logConfig, cancelToken);
+                    Listeners.Add(elistner);
+                    foreach (var output in Outputs)
+                        output.Connect(elistner);
+                }
+
+                foreach (var tcp in config.Tcps)
                 {
                     var elistner = new TcpInputListener(cancelToken, tcp.Port);
                     Listeners.Add(elistner);
@@ -208,7 +242,7 @@ namespace TimberWinR
                         output.Connect(elistner);
                 }
 
-                foreach (var udp in Config.Udps)
+                foreach (var udp in config.Udps)
                 {
                     var elistner = new UdpInputListener(cancelToken, udp.Port);
                     Listeners.Add(elistner);
@@ -216,7 +250,7 @@ namespace TimberWinR
                         output.Connect(elistner);
                 }
 
-                foreach (var stdin in Config.Stdins)
+                foreach (var stdin in config.Stdins)
                 {
                     var elistner = new StdinListener(stdin, cancelToken);
                     Listeners.Add(elistner);
@@ -225,28 +259,29 @@ namespace TimberWinR
                 }
 
                 var computerName = System.Environment.MachineName + "." +
-                       Microsoft.Win32.Registry.LocalMachine.OpenSubKey(
-                           @"SYSTEM\CurrentControlSet\services\Tcpip\Parameters")
-                           .GetValue("Domain", "")
-                           .ToString();
+                                   Microsoft.Win32.Registry.LocalMachine.OpenSubKey(
+                                       @"SYSTEM\CurrentControlSet\services\Tcpip\Parameters")
+                                       .GetValue("Domain", "")
+                                       .ToString();
 
                 foreach (var output in Outputs)
                 {
                     var name = Assembly.GetExecutingAssembly().GetName();
                     JObject json = new JObject(
-                     new JProperty("TimberWinR",
-                         new JObject(
-                             new JProperty("version", GetAssemblyByName("TimberWinR.ServiceHost").GetName().Version.ToString()),
-                             new JProperty("host", computerName),
-                             new JProperty("output", output.Name),
-                             new JProperty("initialized", DateTime.UtcNow)
-                             )));
+                        new JProperty("TimberWinR",
+                            new JObject(
+                                new JProperty("version",
+                                    Assembly.GetEntryAssembly().GetName().Version.ToString()),
+                                    //GetAssemblyByName("TimberWinR.ServiceHost").GetName().Version.ToString()),
+                                new JProperty("host", computerName),
+                                new JProperty("output", output.Name),
+                                new JProperty("initialized", DateTime.UtcNow)
+                                )));
                     json.Add(new JProperty("type", "Win32-TimberWinR"));
                     json.Add(new JProperty("host", computerName));
                     output.Startup(json);
-                }
+                }              
             }
-
         }
 
 

TimberWinR/Outputs/Elasticsearch.cs

@@ -2,52 +2,91 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Net;
+using System.Net.Sockets;
+using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
+using Elasticsearch.Net;
+using Elasticsearch.Net.ConnectionPool;
+using Nest;
 using Newtonsoft.Json.Linq;
 using NLog;
 using RapidRegex.Core;
 using RestSharp;
+using System.Text.RegularExpressions;
+using Elasticsearch.Net.Serialization;
+using Newtonsoft.Json;
 
 namespace TimberWinR.Outputs
 {
-    using System.Text.RegularExpressions;
+    public class Person
+    {
+        public string Firstname { get; set; }
+        public string Lastname { get; set; }
+    }
 
     public partial class ElasticsearchOutput : OutputSender
     {
         private TimberWinR.Manager _manager;
         private readonly int _port;
         private readonly int _interval;
-        private readonly string[] _host;
-        private readonly string _protocol;
-        private int _hostIndex;
+        private readonly int _flushSize;
+        private readonly int _idleFlushTimeSeconds;
+        private readonly string[] _hosts;
+        private readonly string _protocol;      
         private readonly int _timeout;
         private readonly object _locker = new object();
         private readonly List<JObject> _jsonQueue;
         private readonly int _numThreads;
         private long _sentMessages;
         private long _errorCount;
-        private Parser.ElasticsearchOutput eo;
+        private readonly int _maxQueueSize;
+        private readonly bool _queueOverflowDiscardOldest;    
+        private Parser.ElasticsearchOutputParameters _parameters;
         public bool Stop { get; set; }
+      
+        /// <summary>
+        /// Get the bulk connection pool of hosts
+        /// </summary>
+        /// <returns></returns>
+        private ElasticClient getClient()
+        {
+            var nodes = new List<Uri>();
+            foreach (var host in _hosts)
+            {
+                var url = string.Format("http://{0}:{1}", host, _port);
+                nodes.Add(new Uri(url));
+            }
+            var pool = new StaticConnectionPool(nodes.ToArray());
+            var settings = new ConnectionSettings(pool)
+                .ExposeRawResponse();
 
-        public ElasticsearchOutput(TimberWinR.Manager manager, Parser.ElasticsearchOutput eo, CancellationToken cancelToken)
+            var client = new ElasticClient(settings);
+            return client;
+        }
+
+        public ElasticsearchOutput(TimberWinR.Manager manager, Parser.ElasticsearchOutputParameters parameters, CancellationToken cancelToken)
             : base(cancelToken, "Elasticsearch")
         {
             _sentMessages = 0;
             _errorCount = 0;
 
-            this.eo = eo;
-            _protocol = eo.Protocol;
-            _timeout = eo.Timeout;
+            _parameters = parameters;
+            _flushSize = parameters.FlushSize;
+            _idleFlushTimeSeconds = parameters.IdleFlushTimeInSeconds;
+            _protocol = parameters.Protocol;
+            _timeout = parameters.Timeout;
             _manager = manager;
-            _port = eo.Port;
-            _interval = eo.Interval;
-            _host = eo.Host;
-            _hostIndex = 0;
+            _port = parameters.Port;
+            _interval = parameters.Interval;
+            _hosts = parameters.Host;          
             _jsonQueue = new List<JObject>();
-            _numThreads = eo.NumThreads;
+            _numThreads = parameters.NumThreads;
+            _maxQueueSize = parameters.MaxQueueSize;
+            _queueOverflowDiscardOldest = parameters.QueueOverflowDiscardOldest;
+      
 
-            for (int i = 0; i < eo.NumThreads; i++)
+            for (int i = 0; i < parameters.NumThreads; i++)
             {
                 Task.Factory.StartNew(ElasticsearchSender, cancelToken, TaskCreationOptions.LongRunning, TaskScheduler.Current);
             }
@@ -58,16 +97,20 @@ namespace TimberWinR.Outputs
             JObject json = new JObject(
                 new JProperty("elasticsearch",
                     new JObject(
-                        new JProperty("host", string.Join(",", _host)),
+                        new JProperty("host", string.Join(",", _hosts)),
                         new JProperty("errors", _errorCount),
-                        new JProperty("sent_messages", _sentMessages),
-                        new JProperty("queued_messages", _jsonQueue.Count),
+                        new JProperty("sentMmessageCount", _sentMessages),
+                        new JProperty("queuedMessageCount", _jsonQueue.Count),
                         new JProperty("port", _port),
+                        new JProperty("flushSize", _flushSize),                                       
+                        new JProperty("idleFlushTime", _idleFlushTimeSeconds),     
                         new JProperty("interval", _interval),
                         new JProperty("threads", _numThreads),
+                        new JProperty("maxQueueSize", _maxQueueSize),
+                        new JProperty("overflowDiscardOldest", _queueOverflowDiscardOldest),               
                         new JProperty("hosts",
                             new JArray(
-                                from h in _host
+                                from h in _hosts
                                 select new JObject(
                                     new JProperty("host", h)))))));
             return json;
@@ -77,137 +120,145 @@ namespace TimberWinR.Outputs
         // 
         private void ElasticsearchSender()
         {
+            // Force an inital flush
+            DateTime lastFlushTime = DateTime.MinValue;
+
             using (var syncHandle = new ManualResetEventSlim())
-            {
+            {               
                 // Execute the query
                 while (!Stop)
-                {
+                {          
                     if (!CancelToken.IsCancellationRequested)
                     {
                         try
-                        {
-                            JObject[] messages;
+                        {                           
+                            int messageCount = 0;
+                            List<JObject> messages = new List<JObject>();
+                            
+                            // Lets get whats in the queue
                             lock (_locker)
                             {
-                                var count = _jsonQueue.Count;
-                                messages = _jsonQueue.Take(count).ToArray();
-                                _jsonQueue.RemoveRange(0, count);
-                                if (messages.Length > 0)
-                                    _manager.IncrementMessageCount(messages.Length);
+                                messageCount = _jsonQueue.Count;
+                                
+                                // Time to flush?                             
+                                if (messageCount >= _flushSize || (DateTime.UtcNow - lastFlushTime).Seconds >= _idleFlushTimeSeconds)
+                                {
+                                    messages = _jsonQueue.Take(messageCount).ToList();
+                                    _jsonQueue.RemoveRange(0, messageCount);
+                                    if (messages.Count > 0)
+                                        _manager.IncrementMessageCount(messages.Count);
+                                }
                             }
 
-                            if (messages.Length > 0)
+                            // We have some messages to work with
+                            if (messages.Count > 0)
                             {
-                                int numHosts = _host.Length;
-                                while (numHosts-- > 0)
+                                var client = getClient();
+
+                                LogManager.GetCurrentClassLogger()
+                                    .Debug("Sending {0} Messages to {1}", messages.Count, string.Join(",", _hosts));
+                                // This loop will process all messages we've taken from the queue
+                                // that have the same index and type (an elasticsearch requirement)
+                                do
                                 {
                                     try
                                     {
-                                        // Get the next client
-                                        RestClient client = getClient();
-                                        if (client != null)
-                                        {
-                                            LogManager.GetCurrentClassLogger()
-                                                .Debug("Sending {0} Messages to {1}", messages.Length, client.BaseUrl);
+                                        // Grab all messages with same index and type (this is the whole point, group the same ones) 
+                                        var bulkTypeName = this._parameters.GetTypeName(messages[0]);
+                                        var bulkIndexName = this._parameters.GetIndexName(messages[0]);
 
-                                            foreach (JObject json in messages)
-                                            {
-                                                var typeName = this.eo.GetTypeName(json);
-                                                var indexName = this.eo.GetIndexName(json);
-                                                var req =
-                                                    new RestRequest(string.Format("/{0}/{1}/", indexName, typeName),
-                                                        Method.POST);
-
-                                                req.AddParameter("text/json", json.ToString(), ParameterType.RequestBody);
-
-                                                req.RequestFormat = DataFormat.Json;
-
-                                                try
-                                                {
-                                                    client.ExecuteAsync(req, response =>
-                                                    {
-                                                        if (response.StatusCode != HttpStatusCode.Created)
-                                                        {
-                                                            LogManager.GetCurrentClassLogger()
-                                                                .Error("Failed to send: {0}", response.ErrorMessage);
-                                                            Interlocked.Increment(ref _errorCount);
-                                                        }
-                                                        else
-                                                        {
-                                                            _sentMessages++;
-                                                            GC.Collect();
-                                                        }
-                                                    });
-                                                }
-                                                catch (Exception error)
-                                                {
-                                                    LogManager.GetCurrentClassLogger().Error(error);
-                                                    Interlocked.Increment(ref _errorCount);
-                                                }
-                                            }
-                                            GC.Collect();
-                                        }
-                                        else
-                                        {
-                                            LogManager.GetCurrentClassLogger()
-                                                .Fatal("Unable to connect with any Elasticsearch hosts, {0}",
-                                                    String.Join(",", _host));
-                                            Interlocked.Increment(ref _errorCount);
-                                        }
+                                        IEnumerable<JObject> bulkItems =
+                                            messages.TakeWhile(
+                                                message =>
+                                                    String.Compare(bulkTypeName, _parameters.GetTypeName(message), false) == 0 &&
+                                                    String.Compare(bulkIndexName, _parameters.GetIndexName(message), false) == 0);
 
+                                        // Send the message(s), if the are successfully sent, they
+                                        // are removed from the queue
+                                        lastFlushTime = transmitBulkData(bulkItems, bulkIndexName, bulkTypeName, client, lastFlushTime, messages);
+                                        
+                                        GC.Collect();
                                     }
                                     catch (Exception ex)
                                     {
                                         LogManager.GetCurrentClassLogger().Error(ex);
-                                        Interlocked.Increment(ref _errorCount);
+                                        break;
                                     }
-                                }
+                                } while (messages.Count > 0);
                             }
                             GC.Collect();
                             if (!Stop)
-                            {                              
-                                syncHandle.Wait(TimeSpan.FromMilliseconds(_interval), CancelToken);  
+                            {
+                                syncHandle.Wait(TimeSpan.FromMilliseconds(_interval), CancelToken);
                             }
-                          }
-                        catch (OperationCanceledException oce)
+                        }
+                        catch (OperationCanceledException)
                         {
                             break;
                         }
-                        catch (Exception)
+                        catch (Exception ex)
                         {
-                            throw;
+                            LogManager.GetCurrentClassLogger().Error(ex);
                         }
                     }
                 }
             }
         }
-        private RestClient getClient()
+
+        //
+        // Send the messages to Elasticsearch (bulk)
+        //
+        private DateTime transmitBulkData(IEnumerable<JObject> bulkItems, string bulkIndexName, string bulkTypeName,
+            ElasticClient client, DateTime lastFlushTime, List<JObject> messages)
         {
-            if (_hostIndex >= _host.Length)
-                _hostIndex = 0;
-
-            int numTries = 0;
-            while (numTries < _host.Length)
+            var bulkRequest = new BulkRequest() {Refresh = true};
+            bulkRequest.Operations = new List<IBulkOperation>();
+            foreach (var json in bulkItems)
             {
-                try
-                {
-                    string url = string.Format("{0}://{1}:{2}", _protocol.Replace(":", ""), _host[_hostIndex], _port);
-                    var client = new RestClient(url);
-                    client.Timeout = _timeout;
-
-                    _hostIndex++;
-                    if (_hostIndex >= _host.Length)
-                        _hostIndex = 0;
-
-                    return client;
-                }
-                catch (Exception)
-                {
-                }
-                numTries++;
+                // ES requires a timestamp, add one if not present
+                var ts = json["@timestamp"];
+                if (ts == null)
+                    json["@timestamp"] = DateTime.UtcNow;
+                var bi = new BulkIndexOperation<JObject>(json);
+                bi.Index = bulkIndexName;
+                bi.Type = bulkTypeName;
+                bulkRequest.Operations.Add(bi);
             }
 
-            return null;
+            // The total messages processed for this operation.
+            int numMessages = bulkItems.Count();
+     
+            var response = client.Bulk(bulkRequest);
+            if (!response.IsValid)
+            {
+                LogManager.GetCurrentClassLogger().Error("Failed to send: {0}", response);
+                Interlocked.Increment(ref _errorCount);
+                interlockedInsert(messages);  // Put the messages back into the queue
+            }
+            else // Success!
+            {
+                lastFlushTime = DateTime.UtcNow;
+                LogManager.GetCurrentClassLogger()
+                    .Info("Successfully sent {0} messages in a single bulk request", numMessages);
+                Interlocked.Add(ref _sentMessages, numMessages);                              
+            }
+
+            // Remove them from the working list
+            messages.RemoveRange(0, numMessages);
+            return lastFlushTime;
+        }
+
+        // Places messages back into the queue (for a future attempt)
+        private void interlockedInsert(List<JObject> messages)
+        {
+            lock (_locker)
+            {
+                _jsonQueue.InsertRange(0, messages);
+                if (_jsonQueue.Count > _maxQueueSize)
+                {
+                    LogManager.GetCurrentClassLogger().Warn("Exceeded maximum queue depth");
+                }
+            }
         }
 
 
@@ -217,10 +268,30 @@ namespace TimberWinR.Outputs
                 ApplyFilters(jsonMessage);
 
             var message = jsonMessage.ToString();
-            LogManager.GetCurrentClassLogger().Debug(message);
+            LogManager.GetCurrentClassLogger().Trace(message);
 
             lock (_locker)
             {
+                if (_jsonQueue.Count >= _maxQueueSize)
+                {
+                    // If we've exceeded our queue size, and we're supposed to throw out the oldest objects first,
+                    // then remove as many as necessary to get us under our limit
+                    if (_queueOverflowDiscardOldest)
+                    {
+                        LogManager.GetCurrentClassLogger()
+                            .Warn("Overflow discarding oldest {0} messages", _jsonQueue.Count - _maxQueueSize + 1);
+
+                        _jsonQueue.RemoveRange(0, (_jsonQueue.Count - _maxQueueSize) + 1);
+                    }
+                    // Otherwise we're in a "discard newest" mode, and this is the newest message, so just ignore it
+                    else
+                    {
+                        LogManager.GetCurrentClassLogger()
+                            .Warn("Overflow discarding newest message: {0}", message);
+
+                        return;
+                    }
+                }
                 _jsonQueue.Add(jsonMessage);
             }
         }

TimberWinR/Outputs/Redis.cs

@@ -1,11 +1,12 @@
 using System;
 using System.Collections.Generic;
+using System.Diagnostics.Eventing.Reader;
 using System.Linq;
 using System.Linq.Expressions;
 using System.Net.Sockets;
 using System.Text;
 using System.Threading;
-using ctstone.Redis;
+using CSRedis;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Linq;
 using NLog;
@@ -17,32 +18,126 @@ using TimberWinR.Parser;
 
 namespace TimberWinR.Outputs
 {
+    internal class BatchCounter
+    {
+        // Total number of times reached max batch count (indicates we are under pressure)
+        public int ReachedMaxBatchCountTimes { get; set; }
+
+        private readonly int[] _sampleQueueDepths;
+        private int _sampleCountIndex;
+        private const int QUEUE_SAMPLE_SIZE = 30; // 30 samples over 2.5 minutes (default)
+        private object _locker = new object();
+        private bool _warnedReachedMax;
+
+        private readonly int _maxBatchCount;
+        private readonly int _batchCount;
+        private int _totalSamples;
+
+        public int[] Samples()
+        {
+            return _sampleQueueDepths;
+        }
+
+        public BatchCounter(int batchCount, int maxBatchCount)
+        {
+            _batchCount = batchCount;
+            _maxBatchCount = maxBatchCount;
+            _sampleQueueDepths = new int[QUEUE_SAMPLE_SIZE];
+            _sampleCountIndex = 0;
+            _totalSamples = 0;
+            ReachedMaxBatchCountTimes = 0;
+        }
+        public void SampleQueueDepth(int queueDepth)
+        {
+            lock (_locker)
+            {
+                if (_totalSamples < QUEUE_SAMPLE_SIZE)
+                    _totalSamples++;
+
+                // Take a sample of the queue depth
+                if (_sampleCountIndex >= QUEUE_SAMPLE_SIZE)
+                    _sampleCountIndex = 0;
+
+                _sampleQueueDepths[_sampleCountIndex++] = queueDepth;
+            }
+        }
+
+        public int AverageQueueDepth()
+        {
+            lock (_locker)
+            {
+                if (_totalSamples > 0)
+                {
+                    var samples = _sampleQueueDepths.Take(_totalSamples);
+                    int avg = (int)samples.Average();
+                    return avg;
+                }
+                return 0;
+            }
+        }
+
+        // Sample the queue and adjust the batch count if needed (ramp up slowly)
+        public int UpdateCurrentBatchCount(int queueSize, int currentBatchCount)
+        {
+            if (currentBatchCount < _maxBatchCount && currentBatchCount < queueSize && AverageQueueDepth() > currentBatchCount)
+            {
+                currentBatchCount += Math.Max(_maxBatchCount / _batchCount, 1);
+                if (currentBatchCount >= _maxBatchCount && !_warnedReachedMax)
+                {
+                    LogManager.GetCurrentClassLogger().Warn("Maximum Batch Count of {0} reached.", currentBatchCount);
+                    _warnedReachedMax = true; // Only complain when it's reached (1 time, unless reset)
+                    ReachedMaxBatchCountTimes++;
+                    currentBatchCount = _maxBatchCount;
+                }
+            }
+            else // Reset to default
+            {
+                currentBatchCount = _batchCount;
+                _warnedReachedMax = false;
+            }
+
+            return currentBatchCount;
+        }
+    }
+
+
     public class RedisOutput : OutputSender
     {
+        public int QueueDepth
+        {
+            get { return _jsonQueue.Count; }
+        }
+
+        public long SentMessages
+        {
+            get { return _sentMessages; }
+        }
+
         private readonly string _logstashIndexName;
         private readonly int _port;
         private readonly int _timeout;
         private readonly object _locker = new object();
         private readonly List<string> _jsonQueue;
-        // readonly Task _consumerTask;
         private readonly string[] _redisHosts;
         private int _redisHostIndex;
         private TimberWinR.Manager _manager;
         private readonly int _batchCount;
+        private int _currentBatchCount;
+        private readonly int _maxBatchCount;
         private readonly int _interval;
         private readonly int _numThreads;
-
         private long _sentMessages;
         private long _errorCount;
         private long _redisDepth;
-
-        private int _maxQueueSize;
-        private bool _queueOverflowDiscardOldest;
+        private DateTime? _lastErrorTimeUTC;
+        private readonly int _maxQueueSize;
+        private readonly bool _queueOverflowDiscardOldest;
+        private BatchCounter _batchCounter;
 
         public bool Stop { get; set; }
 
         /// <summary>
-        /// Get the next client
+        /// Get the next client from the list of hosts.
         /// </summary>
         /// <returns></returns>
         private RedisClient getClient()
@@ -55,16 +150,19 @@ namespace TimberWinR.Outputs
             {
                 try
                 {
-                    RedisClient client = new RedisClient(_redisHosts[_redisHostIndex], _port, _timeout);
+                    RedisClient client = new RedisClient(_redisHosts[_redisHostIndex], _port);                   
+                    return client;
+                }
+                catch (Exception ex)
+                {
+                    LogManager.GetCurrentClassLogger().Error(ex);
 
+                }
+                finally
+                {
                     _redisHostIndex++;
                     if (_redisHostIndex >= _redisHosts.Length)
                         _redisHostIndex = 0;
-
-                    return client;
-                }
-                catch (Exception)
-                {
                 }
                 numTries++;
             }
@@ -79,15 +177,21 @@ namespace TimberWinR.Outputs
                     new JObject(
                         new JProperty("host", string.Join(",", _redisHosts)),
                         new JProperty("errors", _errorCount),
-                        new JProperty("redis_depth", _redisDepth),
-                        new JProperty("sent_messages", _sentMessages),
-                        new JProperty("queued_messages", _jsonQueue.Count),
+                        new JProperty("lastErrorTimeUTC", _lastErrorTimeUTC),
+                        new JProperty("redisQueueDepth", _redisDepth),
+                        new JProperty("sentMessageCount", _sentMessages),
+                        new JProperty("queuedMessageCount", _jsonQueue.Count),
                         new JProperty("port", _port),
                         new JProperty("maxQueueSize", _maxQueueSize),
                         new JProperty("overflowDiscardOldest", _queueOverflowDiscardOldest),
                         new JProperty("interval", _interval),
                         new JProperty("threads", _numThreads),
                         new JProperty("batchcount", _batchCount),
+                        new JProperty("currentBatchCount", _currentBatchCount),
+                        new JProperty("reachedMaxBatchCountTimes", _batchCounter.ReachedMaxBatchCountTimes),
+                        new JProperty("maxBatchCount", _maxBatchCount),
+                        new JProperty("averageQueueDepth", _batchCounter.AverageQueueDepth()),
+                        new JProperty("queueSamples", new JArray(_batchCounter.Samples())),
                         new JProperty("index", _logstashIndexName),
                         new JProperty("hosts",
                             new JArray(
@@ -97,25 +201,33 @@ namespace TimberWinR.Outputs
             return json;
         }
 
-        public RedisOutput(TimberWinR.Manager manager, Parser.RedisOutput ro, CancellationToken cancelToken)
+        public RedisOutput(TimberWinR.Manager manager, Parser.RedisOutputParameters parameters, CancellationToken cancelToken)
             : base(cancelToken, "Redis")
         {
             _redisDepth = 0;
-            _batchCount = ro.BatchCount;
+            _batchCount = parameters.BatchCount;
+            _maxBatchCount = parameters.MaxBatchCount;
+            // Make sure maxBatchCount is larger than batchCount
+            if (_maxBatchCount <= _batchCount)
+                _maxBatchCount = _batchCount * 10;
+
             _manager = manager;
             _redisHostIndex = 0;
-            _redisHosts = ro.Host;
+            _redisHosts = parameters.Host;
             _jsonQueue = new List<string>();
-            _port = ro.Port;
-            _timeout = ro.Timeout;
-            _logstashIndexName = ro.Index;
-            _interval = ro.Interval;
-            _numThreads = ro.NumThreads;
+            _port = parameters.Port;
+            _timeout = parameters.Timeout;
+            _logstashIndexName = parameters.Index;
+            _interval = parameters.Interval;
+            _numThreads = parameters.NumThreads;
             _errorCount = 0;
-            _maxQueueSize = ro.MaxQueueSize;
-            _queueOverflowDiscardOldest = ro.QueueOverflowDiscardOldest;
+            _lastErrorTimeUTC = null;
+            _maxQueueSize = parameters.MaxQueueSize;
+            _queueOverflowDiscardOldest = parameters.QueueOverflowDiscardOldest;
+            _batchCounter = new BatchCounter(_batchCount, _maxBatchCount);
+            _currentBatchCount = _batchCount;
 
-            for (int i = 0; i < ro.NumThreads; i++)
+            for (int i = 0; i < parameters.NumThreads; i++)
             {
                 var redisThread = new Task(RedisSender, cancelToken);
                 redisThread.Start();
@@ -140,7 +252,7 @@ namespace TimberWinR.Outputs
             }
 
             var message = jsonMessage.ToString();
-            LogManager.GetCurrentClassLogger().Debug(message);
+            LogManager.GetCurrentClassLogger().Trace(message);
 
             lock (_locker)
             {
@@ -175,14 +287,13 @@ namespace TimberWinR.Outputs
             foreach (var filter in _manager.Config.Filters)
             {
                 if (!filter.Apply(json))
-                {  
-                    LogManager.GetCurrentClassLogger().Debug("Dropping: {0}", json.ToString());
+                {
+                    LogManager.GetCurrentClassLogger().Debug("{0}: Dropping: {1}", Thread.CurrentThread.ManagedThreadId, json.ToString());
                     drop = true;
-                }              
+                }
             }
             return drop;
         }
-
         // 
         // Pull off messages from the Queue, batch them up and send them all across
         // 
@@ -198,17 +309,21 @@ namespace TimberWinR.Outputs
                         try
                         {
                             string[] messages;
+                            // Exclusively
                             lock (_locker)
                             {
-                                messages = _jsonQueue.Take(_batchCount).ToArray();
+                                _batchCounter.SampleQueueDepth(_jsonQueue.Count);
+                                // Re-compute current batch size
+                                _currentBatchCount = _batchCounter.UpdateCurrentBatchCount(_jsonQueue.Count, _currentBatchCount);
+
+                                messages = _jsonQueue.Take(_currentBatchCount).ToArray();
                                 _jsonQueue.RemoveRange(0, messages.Length);
-                                if (messages.Length > 0)
-                                    _manager.IncrementMessageCount(messages.Length);
                             }
 
                             if (messages.Length > 0)
                             {
                                 int numHosts = _redisHosts.Length;
+                                bool sentSuccessfully = false;
                                 while (numHosts-- > 0)
                                 {
                                     try
@@ -220,21 +335,28 @@ namespace TimberWinR.Outputs
                                             {
                                                 client.StartPipe();
                                                 LogManager.GetCurrentClassLogger()
-                                                    .Debug("Sending {0} Messages to {1}", messages.Length, client.Host);
+                                                    .Debug("{0}: Sending {1} Messages to {2}", Thread.CurrentThread.ManagedThreadId, messages.Length, client.Host);
 
                                                 try
                                                 {
                                                     _redisDepth = client.RPush(_logstashIndexName, messages);
-                                                    _sentMessages += messages.Length;
+                                                    Interlocked.Add(ref _sentMessages, messages.Length);
+                                                    client.EndPipe();
+                                                    sentSuccessfully = true;
+                                                    if (messages.Length > 0)
+                                                        _manager.IncrementMessageCount(messages.Length);
                                                 }
                                                 catch (SocketException ex)
                                                 {
                                                     LogManager.GetCurrentClassLogger().Warn(ex);
                                                     Interlocked.Increment(ref _errorCount);
+                                                    _lastErrorTimeUTC = DateTime.UtcNow;
                                                 }
-                                                finally
+                                                catch (Exception ex)
                                                 {
-                                                    client.EndPipe();
+                                                    LogManager.GetCurrentClassLogger().Error(ex);
+                                                    Interlocked.Increment(ref _errorCount);
+                                                    _lastErrorTimeUTC = DateTime.UtcNow;
                                                 }
                                                 break;
                                             }
@@ -244,6 +366,7 @@ namespace TimberWinR.Outputs
                                                 LogManager.GetCurrentClassLogger()
                                                     .Fatal("Unable to connect with any Redis hosts, {0}",
                                                         String.Join(",", _redisHosts));
+                                                _lastErrorTimeUTC = DateTime.UtcNow;
                                             }
                                         }
                                     }
@@ -251,21 +374,35 @@ namespace TimberWinR.Outputs
                                     {
                                         LogManager.GetCurrentClassLogger().Error(ex);
                                         Interlocked.Increment(ref _errorCount);
+                                        _lastErrorTimeUTC = DateTime.UtcNow;
+                                    }
+                                } // No more hosts to try.
+
+                                // Couldn't send, put it back into the queue.
+                                if (!sentSuccessfully)
+                                {
+                                    lock (_locker)
+                                    {
+                                        _jsonQueue.InsertRange(0, messages);
                                     }
                                 }
-                            }
-                            GC.Collect();
+                            }                          
                             if (!Stop)
                                 syncHandle.Wait(TimeSpan.FromMilliseconds(_interval), CancelToken);
                         }
-                        catch (OperationCanceledException oce)
+                        catch (OperationCanceledException)
+                        {
+                            break;
+                        }
+                        catch (ThreadAbortException)
                         {
                             break;
                         }
                         catch (Exception ex)
                         {
-
-                            throw;
+                            _lastErrorTimeUTC = DateTime.UtcNow;
+                            Interlocked.Increment(ref _errorCount);
+                            LogManager.GetCurrentClassLogger().Error(ex);
                         }
                     }
                 }

TimberWinR/Outputs/Stdout.cs

@@ -17,7 +17,7 @@ namespace TimberWinR.Outputs
         private long _sentMessages;
         public bool Stop { get; set; }
 
-        public StdoutOutput(TimberWinR.Manager manager, Parser.StdoutOutput eo, CancellationToken cancelToken)
+        public StdoutOutput(TimberWinR.Manager manager, Parser.StdoutOutputParameters eo, CancellationToken cancelToken)
             : base(cancelToken, "Stdout")
         {
             _sentMessages = 0;
@@ -34,7 +34,7 @@ namespace TimberWinR.Outputs
             JObject json = new JObject(
                 new JProperty("stdout",
                     new JObject(
-                        new JProperty("sent_messages", _sentMessages))));
+                        new JProperty("sentMessageCount", _sentMessages))));
 
             return json;
         }
@@ -78,7 +78,7 @@ namespace TimberWinR.Outputs
                             if (!Stop)
                                 syncHandle.Wait(TimeSpan.FromMilliseconds(_interval), CancelToken);
                         }
-                        catch (OperationCanceledException oce)
+                        catch (OperationCanceledException)
                         {
                             break;
                         }

TimberWinR/Parser.cs

@@ -255,7 +255,7 @@ namespace TimberWinR.Parser
     public class Stdin : IValidateSchema
     {
         [JsonProperty(PropertyName = "codec")]
-        public Codec Codec { get; set; }
+        public CodecArguments CodecArguments { get; set; }
 
         public void Validate()
         {
@@ -263,7 +263,7 @@ namespace TimberWinR.Parser
         }
     }
 
-    public class Codec
+    public class CodecArguments
     {
         public enum CodecType
         {
@@ -290,14 +290,44 @@ namespace TimberWinR.Parser
 
         public Regex Re { get; set; }
 
-        public Codec()
+        public CodecArguments()
         {
             Negate = false;
             MultilineTag = "multiline";
         }
     }
 
-    public class Log : IValidateSchema
+    public class TailFileArguments : IValidateSchema
+    {
+        [JsonProperty(PropertyName = "location")]
+        public string Location { get; set; }       
+        [JsonProperty(PropertyName = "recurse")]
+        public int Recurse { get; set; }        
+        [JsonProperty(PropertyName = "fields")]
+        public List<Field> Fields { get; set; }
+        [JsonProperty(PropertyName = "interval")]
+        public int Interval { get; set; }
+        [JsonProperty(PropertyName = "logSource")]
+        public string LogSource { get; set; }
+        [JsonProperty(PropertyName = "codec")]
+        public CodecArguments CodecArguments { get; set; }
+
+        public TailFileArguments()
+        {
+            Fields = new List<Field>();
+            Fields.Add(new Field("LogFilename", "string"));
+            Fields.Add(new Field("Index", "integer"));
+            Fields.Add(new Field("Text", "string"));
+            Interval = 30;
+        }
+
+        public void Validate()
+        {
+
+        }
+    }
+
+    public class LogParameters : IValidateSchema
     {
         [JsonProperty(PropertyName = "location")]
         public string Location { get; set; }
@@ -314,9 +344,9 @@ namespace TimberWinR.Parser
         [JsonProperty(PropertyName = "logSource")]
         public string LogSource { get; set; }
         [JsonProperty(PropertyName = "codec")]
-        public Codec Codec { get; set; }
+        public CodecArguments CodecArguments { get; set; }
 
-        public Log()
+        public LogParameters()
         {
             Fields = new List<Field>();
             Fields.Add(new Field("LogFilename", "string"));
@@ -331,12 +361,12 @@ namespace TimberWinR.Parser
         }
     }
 
-    public class Tcp : IValidateSchema
+    public class TcpParameters : IValidateSchema
     {
         [JsonProperty(PropertyName = "port")]
         public int Port { get; set; }
 
-        public Tcp()
+        public TcpParameters()
         {
             Port = 5140;
         }
@@ -348,12 +378,12 @@ namespace TimberWinR.Parser
     }
 
 
-    public class Udp : IValidateSchema
+    public class UdpParameters : IValidateSchema
     {
         [JsonProperty(PropertyName = "port")]
         public int Port { get; set; }
 
-        public Udp()
+        public UdpParameters()
         {
             Port = 5142;
         }
@@ -363,7 +393,7 @@ namespace TimberWinR.Parser
 
         }
     }
-    public class W3CLog : IValidateSchema
+    public class W3CLogParameters : IValidateSchema
     {
         [JsonProperty(PropertyName = "location")]
         public string Location { get; set; }
@@ -380,7 +410,7 @@ namespace TimberWinR.Parser
         [JsonProperty(PropertyName = "fields")]
         public List<Field> Fields { get; set; }
 
-        public W3CLog()
+        public W3CLogParameters()
         {
             CodePage = 0;
             DtLines = 10;
@@ -398,7 +428,7 @@ namespace TimberWinR.Parser
     }
 
 
-    public class IISW3CLog : IValidateSchema
+    public class IISW3CLogParameters : IValidateSchema
     {
         [JsonProperty(PropertyName = "location")]
         public string Location { get; set; }
@@ -418,7 +448,7 @@ namespace TimberWinR.Parser
         [JsonProperty(PropertyName = "fields")]
         public List<Field> Fields { get; set; }
 
-        public IISW3CLog()
+        public IISW3CLogParameters()
         {
             CodePage = -2;
             Recurse = 0;
@@ -464,7 +494,7 @@ namespace TimberWinR.Parser
         }
     }
 
-    public class ElasticsearchOutput
+    public class ElasticsearchOutputParameters
     {
         const string IndexDatePattern = "(%\\{(?<format>[^\\}]+)\\})";
 
@@ -482,9 +512,19 @@ namespace TimberWinR.Parser
         public string Protocol { get; set; }
         [JsonProperty(PropertyName = "interval")]
         public int Interval { get; set; }
+        [JsonProperty(PropertyName = "flush_size")]
+        public int FlushSize { get; set; }
+        [JsonProperty(PropertyName = "idle_flush_time")]
+        public int IdleFlushTimeInSeconds { get; set; }
+        [JsonProperty(PropertyName = "max_queue_size")]
+        public int MaxQueueSize { get; set; }
+        [JsonProperty(PropertyName = "queue_overflow_discard_oldest")]
+        public bool QueueOverflowDiscardOldest { get; set; }
 
-        public ElasticsearchOutput()
+        public ElasticsearchOutputParameters()
         {
+            FlushSize = 5000;
+            IdleFlushTimeInSeconds = 10;
             Protocol = "http";
             Port = 9200;
             Index = "";
@@ -492,6 +532,8 @@ namespace TimberWinR.Parser
             Timeout = 10000;
             NumThreads = 1;
             Interval = 1000;
+            QueueOverflowDiscardOldest = true;
+            MaxQueueSize = 50000;
         }
 
         public string GetIndexName(JObject json)
@@ -534,7 +576,7 @@ namespace TimberWinR.Parser
 
     }
 
-    public class RedisOutput
+    public class RedisOutputParameters
     {
         [JsonProperty(PropertyName = "host")]
         public string[] Host { get; set; }
@@ -546,6 +588,8 @@ namespace TimberWinR.Parser
         public int Timeout { get; set; }
         [JsonProperty(PropertyName = "batch_count")]
         public int BatchCount { get; set; }
+        [JsonProperty(PropertyName = "max_batch_count")]
+        public int MaxBatchCount { get; set; }
         [JsonProperty(PropertyName = "threads")]
         public int NumThreads { get; set; }
         [JsonProperty(PropertyName = "interval")]
@@ -555,13 +599,14 @@ namespace TimberWinR.Parser
         [JsonProperty(PropertyName = "queue_overflow_discard_oldest")]
         public bool QueueOverflowDiscardOldest { get; set; }
 
-        public RedisOutput()
+        public RedisOutputParameters()
         {
             Port = 6379;
             Index = "logstash";
             Host = new string[] { "localhost" };
             Timeout = 10000;
-            BatchCount = 10;
+            BatchCount = 200;
+            MaxBatchCount = BatchCount*10;
             NumThreads = 1;
             Interval = 5000;
             QueueOverflowDiscardOldest = true;
@@ -569,12 +614,12 @@ namespace TimberWinR.Parser
         }
     }
 
-    public class StdoutOutput
+    public class StdoutOutputParameters
     {
         [JsonProperty(PropertyName = "interval")]
         public int Interval { get; set; }
 
-        public StdoutOutput()
+        public StdoutOutputParameters()
         {
             Interval = 1000;
         }
@@ -583,13 +628,13 @@ namespace TimberWinR.Parser
     public class OutputTargets
     {
         [JsonProperty("Redis")]
-        public RedisOutput[] Redis { get; set; }
+        public RedisOutputParameters[] Redis { get; set; }
 
         [JsonProperty("Elasticsearch")]
-        public ElasticsearchOutput[] Elasticsearch { get; set; }
+        public ElasticsearchOutputParameters[] Elasticsearch { get; set; }
 
         [JsonProperty("Stdout")]
-        public StdoutOutput[] Stdout { get; set; }
+        public StdoutOutputParameters[] Stdout { get; set; }
     }
 
     public class InputSources
@@ -598,19 +643,22 @@ namespace TimberWinR.Parser
         public WindowsEvent[] WindowsEvents { get; set; }
 
         [JsonProperty("Logs")]
-        public Log[] Logs { get; set; }
+        public LogParameters[] Logs { get; set; }
+
+        [JsonProperty("TailFiles")]
+        public TailFileArguments[] TailFilesArguments { get; set; }
 
         [JsonProperty("Tcp")]
-        public Tcp[] Tcps { get; set; }
+        public TcpParameters[] Tcps { get; set; }
 
         [JsonProperty("Udp")]
-        public Udp[] Udps { get; set; }
+        public UdpParameters[] Udps { get; set; }
 
         [JsonProperty("IISW3CLogs")]
-        public IISW3CLog[] IISW3CLogs { get; set; }
+        public IISW3CLogParameters[] IISW3CLogs { get; set; }
 
         [JsonProperty("W3CLogs")]
-        public W3CLog[] W3CLogs { get; set; }
+        public W3CLogParameters[] W3CLogs { get; set; }
 
         [JsonProperty("Stdin")]
         public Stdin[] Stdins { get; set; }

TimberWinR/ReleaseNotes.md

@@ -2,67 +2,88 @@
 ==================================
 A Native Windows to Redis/Elasticsearch Logstash Agent which runs as a service.
 
-Version History
+Version / Date
+### 1.3.21.0 - 2015-04-13
+1. Rolled Udp listener support to V4 only, too many issues with dual mode sockets
+   and hosts file.  If we want to add this back, I will add a Udpv6 input.
 
-### 1.3.19.0 - 01/12/2015
+### 1.3.20.0 - 2015-04-03
 
-1. Added support for Multiline codecs for Stdin and Logs listeners, addresses issue #23
+1. A re-factoring of Logs and TailLogs to be more efficient and detect log rolling correctly,
+   this requires http://support.microsoft.com/en-us/kb/172190 which will be detected and
+   set by TimberWinR, however, requires a reboot.
+2. Fixed issue [#38](https://github.com/Cimpress-MCP/TimberWinR/issues/38) diagnostic output not showing drop flag for Grok filter.
+3. Created TimberWinR.TestGenerator for complete testing of TimberWinR
+4. Fixed ipv4/ipv6 thread-safe issue with UdpInputListener which might lead to corrupted input data.
 
-### 1.3.18.0 - 12/22/2014
+### 1.3.19.1 - 2015-03-03
+
+1. Added new Redis parameter _max\_batch\_count_ which increases the _batch\_count_ dynamically over time 
+   to handle input flooding.   Default is _batch\_count_ * 10 
+
+### 1.3.19.0 - 2015-02-26
+
+1. Added support for Multiline codecs for Stdin and Logs listeners, closes issue [#23](https://github.com/Cimpress-MCP/TimberWinR/issues/23)
+2. Added new TailFiles input type which uses a native implementation (more-efficient) than using LogParser's Log
+3. Updated Udp input listner to use UTF8 Encoding rather than ASCII
+4. Reduced noisy complaint about missing log files for Logs listener
+5. Fixed bug when tailing non-existent log files which resulted in high cpu-usage.
+6. Added feature to watch the configuration directory
+
+### 1.3.18.0 - 2014-12-22
 
 1. Fixed bug introduced in 1.3.17.0 which changed the meaning of the delay for Elasticsearch, Redis and Stdout 
 intervals to be interpreted as seconds instead of milliseconds.   1.3.17.0 should not be used.
 2. Removed ability for installer to downgrade which was leading to leaving previous versions laying around (i.e. reverts 1.3.13.0 change)
 
-### 1.3.17.0 - 12/19/2014
+### 1.3.17.0 - 2014-12-19
 
 1. Continued work improving shutdown time by using syncHandle.Wait instead of Thread.Sleep
 
-### 1.3.16.0 - 12/19/2014
+### 1.3.16.0 - 2014-12-19
 
 1. Added logSource property to the Log input to facility the steering of log messages to different indices.
 
-### 1.3.15.0 - 12/12/2014
+### 1.3.15.0 - 2014-12-12
 
 1. Fixed bug whereby if the Udp or Tcp inputs receive an impropery formatted Json it caused the thread to terminate, and ignore
 future messages.
 
-### 1.3.14.0 - 12/11/2014
+### 1.3.14.0 - 2014-12-11
 
 1. Fixed bug with the Grok filter to match properly the value of the Text field against non-blank entries.
 
-### 1.3.13.0 - 12/02/2014
+### 1.3.13.0 - 2014-12-02
 
 1. Fixed MSI installer to allow downgrades.
 
-### 1.3.12.0 - 11/25/2014
+### 1.3.12.0 - 2014-11-25
 
 1. Fixed all remaining memory leaks due to the COM Weak Surrogate which requires an explicit GC.Collect
 
-### 1.3.11.0 - 11/21/2014
+### 1.3.11.0 - 2014-11-21
 
 1. Re-worked WindowsEvent listener to enable shutting down in a quicker fashion.
 
-### 1.3.10.0 - 11/18/2014
+### 1.3.10.0 - 2014-11-18
 
 1. Refactored Conditions handler to use non-leaking evaluator.
 
-### 1.3.9.0 - 11/11/2014
+### 1.3.9.0 - 2014-11-11
 
 1. Merged in pull request #9
 2. Updated chocolately uninstall to preserve GUID
 
-### 1.3.8.0 - 11/06/2014
+### 1.3.8.0 - 2014-11-06
+
 1. Added interval parameter to WindowsEvent input listener
 2. Increased default value for interval to 60 seconds for polling WindowsEvents
 
-### 1.3.7.0 - 10/21/2014
+### 1.3.7.0 - 2014-10-21
+
 1. Added additional information for diagnostics port
 2. Completed minor handling of Log rolling detection
 
-### 1.3.6.0 - 10/16/2014
+### 1.3.6.0 - 2014-10-16
+
 1. Handle rolling of logs whereby the logfile remains the same, but the content resets back to 0 bytes.
-
-
-
-

TimberWinR/TimberWinR.csproj

@@ -12,6 +12,8 @@
     <TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
     <FileAlignment>512</FileAlignment>
     <TargetFrameworkProfile />
+    <SolutionDir Condition="$(SolutionDir) == '' Or $(SolutionDir) == '*Undefined*'">..\</SolutionDir>
+    <RestorePackages>true</RestorePackages>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -32,7 +34,10 @@
   </PropertyGroup>
   <ItemGroup>
     <Reference Include="csredis">
-      <HintPath>..\packages\csredis.1.4.7.1\lib\net40\csredis.dll</HintPath>
+      <HintPath>..\packages\csredis.3.2.1\lib\net40\csredis.dll</HintPath>
+    </Reference>
+    <Reference Include="Elasticsearch.Net">
+      <HintPath>..\packages\Elasticsearch.Net.1.3.1\lib\Elasticsearch.Net.dll</HintPath>
     </Reference>
     <Reference Include="Interop.MSUtil, Version=1.0.0.0, Culture=neutral, processorArchitecture=MSIL">
       <SpecificVersion>False</SpecificVersion>
@@ -40,42 +45,44 @@
       <HintPath>lib\com-logparser\Interop.MSUtil.dll</HintPath>
     </Reference>
     <Reference Include="MaxMind.Db">
-      <HintPath>..\packages\MaxMind.Db.0.2.3.0\lib\net40\MaxMind.Db.dll</HintPath>
-      <Private>True</Private>
+      <HintPath>..\packages\MaxMind.Db.1.0.0.0\lib\net40\MaxMind.Db.dll</HintPath>
     </Reference>
     <Reference Include="MaxMind.GeoIP2">
-      <HintPath>..\packages\MaxMind.GeoIP2.0.4.0.0\lib\net40\MaxMind.GeoIP2.dll</HintPath>
-      <Private>True</Private>
+      <HintPath>..\packages\MaxMind.GeoIP2.2.1.0.0\lib\net40\MaxMind.GeoIP2.dll</HintPath>
+    </Reference>
+    <Reference Include="Nest">
+      <HintPath>..\packages\NEST.1.3.1\lib\Nest.dll</HintPath>
     </Reference>
     <Reference Include="Newtonsoft.Json, Version=6.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
       <SpecificVersion>False</SpecificVersion>
-      <HintPath>..\packages\Newtonsoft.Json.6.0.4\lib\net40\Newtonsoft.Json.dll</HintPath>
+      <HintPath>..\packages\Newtonsoft.Json.6.0.5\lib\net40\Newtonsoft.Json.dll</HintPath>
     </Reference>
     <Reference Include="NLog">
-      <HintPath>..\packages\NLog.3.1.0.0\lib\net40\NLog.dll</HintPath>
+      <HintPath>..\packages\NLog.3.2.0.0\lib\net40\NLog.dll</HintPath>
     </Reference>
     <Reference Include="RapidRegex.Core">
       <HintPath>..\packages\RapidRegex.Core.1.0.0.2\lib\net40\RapidRegex.Core.dll</HintPath>
     </Reference>
     <Reference Include="RestSharp">
-      <HintPath>..\packages\RestSharp.104.4.0\lib\net4\RestSharp.dll</HintPath>
+      <HintPath>..\packages\RestSharp.105.0.0\lib\net4\RestSharp.dll</HintPath>
     </Reference>
     <Reference Include="System" />
     <Reference Include="System.Core" />
     <Reference Include="System.Linq.Dynamic">
-      <HintPath>..\packages\System.Linq.Dynamic.1.0.3\lib\net40\System.Linq.Dynamic.dll</HintPath>
+      <HintPath>..\packages\System.Linq.Dynamic.1.0.4\lib\net40\System.Linq.Dynamic.dll</HintPath>
     </Reference>
     <Reference Include="System.Xml.Linq" />
     <Reference Include="System.Data.DataSetExtensions" />
     <Reference Include="Microsoft.CSharp" />
     <Reference Include="System.Data" />
     <Reference Include="System.Xml" />
-    <Reference Include="Topshelf, Version=3.1.122.0, Culture=neutral, PublicKeyToken=b800c4cfcdeea87b, processorArchitecture=MSIL">
+    <Reference Include="Topshelf, Version=3.1.135.0, Culture=neutral, PublicKeyToken=b800c4cfcdeea87b, processorArchitecture=MSIL">
       <SpecificVersion>False</SpecificVersion>
-      <HintPath>..\packages\Topshelf.3.1.3\lib\net40-full\Topshelf.dll</HintPath>
+      <HintPath>..\packages\Topshelf.3.1.4\lib\net40-full\Topshelf.dll</HintPath>
     </Reference>
   </ItemGroup>
   <ItemGroup>
+    <Compile Include="Codecs\Multiline.cs" />
     <Compile Include="Configuration.cs" />
     <Compile Include="ConfigurationErrors.cs" />
     <Compile Include="Diagnostics\Diagnostics.cs" />
@@ -85,8 +92,11 @@
     <Compile Include="Filters\GeoIPFilter.cs" />
     <Compile Include="Filters\JsonFilter.cs" />
     <Compile Include="Filters\MutateFilter.cs" />
+    <Compile Include="ICodec.cs" />
     <Compile Include="Inputs\FieldDefinitions.cs" />
     <Compile Include="Inputs\IISW3CRowReader.cs" />
+    <Compile Include="Inputs\LogsFileDatabase.cs" />
+    <Compile Include="Inputs\TailFileListener.cs" />
     <Compile Include="Inputs\UdpInputListener.cs" />
     <Compile Include="Inputs\W3CInputListener.cs" />
     <Compile Include="Inputs\IISW3CInputListener.cs" />
@@ -97,6 +107,7 @@
     <Compile Include="Inputs\TcpInputListener.cs" />
     <Compile Include="Inputs\LogsListener.cs" />
     <Compile Include="Inputs\WindowsEvtInputListener.cs" />
+    <Compile Include="LogErrors.cs" />
     <Compile Include="Manager.cs" />
     <Compile Include="Outputs\Elasticsearch.cs" />
     <Compile Include="Outputs\OutputSender.cs" />
@@ -126,6 +137,7 @@
     <None Include="mdocs\DateFilter.md" />
     <None Include="mdocs\Filters.md" />
     <None Include="mdocs\GeoIPFilter.md" />
+    <None Include="mdocs\TailFiles.md" />
     <None Include="mdocs\UdpInput.md" />
     <None Include="mdocs\W3CInput.md" />
     <None Include="mdocs\JsonFilter.md" />
@@ -138,7 +150,9 @@
     <None Include="mdocs\Logs.md" />
     <None Include="mdocs\IISW3CInput.md" />
     <None Include="mdocs\WindowsEvents.md" />
-    <None Include="packages.config" />
+    <None Include="packages.config">
+      <SubType>Designer</SubType>
+    </None>
     <None Include="ReleaseNotes.md" />
   </ItemGroup>
   <ItemGroup>
@@ -149,6 +163,13 @@
   </ItemGroup>
   <ItemGroup />
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <Import Project="$(SolutionDir)\.nuget\NuGet.targets" Condition="Exists('$(SolutionDir)\.nuget\NuGet.targets')" />
+  <Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
+    <PropertyGroup>
+      <ErrorText>This project references NuGet package(s) that are missing on this computer. Enable NuGet Package Restore to download them.  For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
+    </PropertyGroup>
+    <Error Condition="!Exists('$(SolutionDir)\.nuget\NuGet.targets')" Text="$([System.String]::Format('$(ErrorText)', '$(SolutionDir)\.nuget\NuGet.targets'))" />
+  </Target>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">

TimberWinR/mdocs/Codec.md

@@ -8,6 +8,10 @@ The following parameters are allowed when configuring the Codec.
 | *type*            | enum           |Codec type 'multiline'                                                    | Must be 'multiline'           |     |
 | *pattern*         | regex          |Regular expression to be matched                                          | Must be legal .NET Regex      |     |
 | *what*            | enum           |Value can be previous or next                                             | If the pattern matched, does event belong to the next or previous event? |     |
+| *negate*          | bool           |Inverts the pattern sense                                                 | If true, a message not matching the pattern will constitute a match of the multiline filter and the what will be applied. (vice-versa is also true) |  false   |
+| *multiline_tag*   | string         |Tag to be added when multiline conversion is applied                      |                               |  multiline | 
+
+This codec applies to [Logs](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Logs.md) and [Stdin](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/StdinInput.md) only.
 
 Example Input: Mutliline input log file
 
@@ -20,9 +24,10 @@ Example Input: Mutliline input log file
                 "location": "C:\\Logs1\\multiline.log",
                 "recurse": -1,
                 "codec": {
-                "type": "multiline",
-                "pattern": "(^.+Exception: .+)|(^\\s+at .+)|(^\\s+... \\d+ more)|(^\\s*Caused by:.+)",
-                "what": "previous"
+                  "negate": false,
+                  "type": "multiline",
+                  "pattern": "(^.+Exception: .+)|(^\\s+at .+)|(^\\s+... \\d+ more)|(^\\s*Caused by:.+)",
+                  "what": "previous"
                 }
             }
 		 }

TimberWinR/mdocs/ElasticsearchOutput.md

@@ -7,11 +7,15 @@ The following parameters are allowed when configuring the Redis output.
 
 | Parameter     |   Type   |  Description                                                | Details               |  Default |
 | :-------------|:---------|:------------------------------------------------------------| :---------------------------  | :-- |
-| *threads*     | string   | Location of log files(s) to monitor                         | Number of worker theads to send messages | 1 |
-| *interval*    | integer  | Interval in milliseconds to sleep during batch sends        | Interval       | 5000 |
-| *index*       | string   | The index name to use                                       | index used/created | logstash-yyyy.dd.mm |
-| *host*        | [string] | The hostname(s) of your Elasticsearch server(s) | IP or DNS name |  |
-| *port*        | integer  | Redis port number                                           | This port must be open  | 9200  |
+| *flush_size*                    | integer  | Maximum number of messages before flushing           |   | 50000  |
+| *host*                          | [string] | Array of hostname(s) of your Elasticsearch server(s) | IP or DNS name |  |
+| *idle_flush_time*               | integer  | Maximum number of seconds elapsed before triggering a flush           |   | 10  |
+| *index*                         | [string]    | The index name to use                                       | index used/created | logstash-yyyy.dd.mm |
+| *interval*                      | integer  | Interval in milliseconds to sleep during batch sends        | Interval       | 5000 |
+| *max_queue_size*                | integer  | Maximum Elasticsearch queue depth       |  | 50000 |
+| *port*                          | integer  | Elasticsearch port number                                   | This port must be open  | 9200  |
+| *queue_overflow_discard_oldest* | bool  | If true, discard oldest messages when max_queue_size reached otherwise discard newest |  | true |
+| *threads*                       | [string]    | Number of Threads                         | Number of worker threads processing messages | 1 |
 
 ### Index parameter
 If you want to output your data everyday to a new index, use following index format: "index-%{yyyy.MM.dd}". Here date format could be any forwat which you need.
@@ -26,7 +30,7 @@ Example Input:
                     "threads":  1,   
                     "interval": 5000,                             
                     "host": [
-                        "tstlexiceapp006.vistaprint.svc"
+                        "tstlexiceapp006.mycompany.svc"
                     ]
                 }
             ]

TimberWinR/mdocs/JsonFilter.md

@@ -61,7 +61,7 @@ The resulting output would be:
 ```
   {
     "type": "Win32-FileLog",
-    "ComputerName": "dev.vistaprint.net",
+    "ComputerName": "dev.mycompany.net",
     "Text": "{\"Email\":\"james@example.com\",\"Active\":true,\"CreatedDate\":\"2013-01-20T00:00:00Z\",\"Roles\":[\"User\",\"Admin\"]}",
     "stuff": {
       "Email": "james@example.com",

TimberWinR/mdocs/Logs.md

@@ -8,6 +8,7 @@ The following parameters are allowed when configuring WindowsEvents.
 | Parameter         |     Type       |  Description                                                             | Details               |  Default |
 | :---------------- |:---------------| :----------------------------------------------------------------------- | :---------------------------  | :-- |
 | *location*        | string  |Location of file(s) to monitor                                           | Path to text file(s) including wildcards. |     |
+| *logSource*       | string  |Source name                                  | Used for conditions |     |
 | *recurse*         | integer |Max subdirectory recursion level.                                       | 0 disables subdirectory recursion; -1 enables unlimited recursion. | 0 |
 | *splitLongLines*  | boolean |Behavior when event messages or event category names cannot be resolved. |When a text line is longer than 128K characters, the format truncates the line and either discards the remaining of the line (when this parameter is set to "false"), or processes the remainder of the line as a new line (when this parameter is set to "true").| false |
 | *iCodepage*       | integer |Codepage of the text file.                                              | 0 is the system codepage, -1 is UNICODE.                         | 0  |
@@ -21,6 +22,7 @@ Example Input: Monitors all files (recursively) located at C:\Logs1\ matching *.
         "Inputs": {
             "Logs": [
                 {
+                    "logSource": "log files",
                     "location": "C:\\Logs1\\*.log",
                     "recurse": -1
                 }

TimberWinR/mdocs/RedisOutput.md

@@ -8,6 +8,8 @@ The following parameters are allowed when configuring the Redis output.
 | Parameter     |   Type   |  Description                                                | Details               |  Default |
 | :-------------|:---------|:------------------------------------------------------------| :---------------------------  | :-- |
 | *threads*     | string   | Location of log files(s) to monitor                         | Number of worker theads to send messages | 1 |
+| *batch_count* | integer  | Sent as a single message                         | Number of messages to aggregate | 200 |
+| *max_batch_count* | integer  | Dynamically adjusted count maximum                      | Increases over time | batch_count*10 |
 | *interval*    | integer  | Interval in milliseconds to sleep during batch sends        | Interval      | 5000 |
 | *index*       | string   | The name of the redis list                                  | logstash index name | logstash |
 | *host*        | [string] | The hostname(s) of your Redis server(s) | IP or DNS name |  |
@@ -26,7 +28,7 @@ Example Input:
                     "interval": 5000, 
                     "batch_count":  500,              
                     "host": [
-                        "tstlexiceapp006.vistaprint.svc"
+                        "tstlexiceapp006.mycompany.svc"
                     ]
                 }
             ]

TimberWinR/mdocs/StdinInput.md

@@ -3,7 +3,12 @@
 The Stdin Input will read from the console (Console.ReadLine) and build a simple message for testing.
 
 ## Parameters
-There are no Parameters at this time.
+The following parameters are allowed when configuring WindowsEvents.
+
+| Parameter         |     Type       |  Description                                                             | Details               |  Default |
+| :---------------- |:---------------| :----------------------------------------------------------------------- | :---------------------------  | :-- |
+| [codec](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Codec.md)  | object | Codec to use  |
+
 
 ```json
 {
@@ -26,5 +31,3 @@ A field: "type": "Win32-Stdin" is automatically appended, and the entire JSON is
 | ---- |:-----| :-----------------------------------------------------------------------|
 | type | STRING |Win32-Stdin |
 | message | STRING | The message typed in  |
-| [codec](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Codec.md)  | object | Codec to use  |
-

TimberWinR/mdocs/TailFiles.md

@@ -0,0 +1,41 @@
+# Input: TailFiles
+
+The TailFiles input will monitor a log (text) file similar to how a Linux "tail -f" command works.  This uses
+a native implementation rather than uses LogParser
+
+## Parameters
+The following parameters are allowed when configuring WindowsEvents.
+
+| Parameter         |     Type       |  Description                                                             | Details               |  Default |
+| :---------------- |:---------------| :----------------------------------------------------------------------- | :---------------------------  | :-- |
+| *location*        | string  |Location of file(s) to monitor                                           | Path to text file(s) including wildcards. |     |
+| *logSource*       | string  |Source name                                  | Used for conditions |     |
+| *recurse*         | integer |Max subdirectory recursion level.                                       | 0 disables subdirectory recursion; -1 enables unlimited recursion. | 0 |
+| *interval*        | integer |Polling interval in seconds                                     | Defaults every 60 seconds | 60 |
+| [codec](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Codec.md)  | object | Codec to use  |
+
+Example Input: Monitors all files (recursively) located at C:\Logs1\ matching *.log as a pattern.  I.e. C:\Logs1\foo.log, C:\Logs1\Subdir\Log2.log, etc.
+
+```json
+{
+    "TimberWinR": {
+        "Inputs": {
+            "TailFiles": [
+                {
+                    "logSource": "log files",
+                    "location": "C:\\Logs1\\*.log",
+                    "recurse": -1
+                }
+            ]
+		}
+	}
+}
+```
+## Fields
+After a successful parse of an event, the following fields are added:
+
+| Name | Type | Description |
+| ---- |:-----| :-----------|
+| LogFilename | STRING |Full path of the file containing this line | 
+| Index | INTEGER | Line number |
+| Text | STRING | Text line content  |

TimberWinR/packages.config

@@ -1,11 +1,14 @@
 <?xml version="1.0" encoding="utf-8"?>
 <packages>
-  <package id="csredis" version="1.4.7.1" targetFramework="net40" />
-  <package id="MaxMind.Db" version="0.2.3.0" targetFramework="net40" />
-  <package id="MaxMind.GeoIP2" version="0.4.0.0" targetFramework="net40" />
-  <package id="Newtonsoft.Json" version="6.0.4" targetFramework="net40" />
-  <package id="NLog" version="3.1.0.0" targetFramework="net40" />
+  <package id="csredis" version="3.2.1" targetFramework="net40" />
+  <package id="Elasticsearch.Net" version="1.3.1" targetFramework="net40" />
+  <package id="MaxMind.Db" version="1.0.0.0" targetFramework="net40" />
+  <package id="MaxMind.GeoIP2" version="2.1.0.0" targetFramework="net40" />
+  <package id="NEST" version="1.3.1" targetFramework="net40" />
+  <package id="Newtonsoft.Json" version="6.0.5" targetFramework="net40" />
+  <package id="NLog" version="3.2.0.0" targetFramework="net40" />
   <package id="RapidRegex.Core" version="1.0.0.2" targetFramework="net40" />
-  <package id="RestSharp" version="104.4.0" targetFramework="net40" />
-  <package id="System.Linq.Dynamic" version="1.0.3" targetFramework="net40" />
+  <package id="RestSharp" version="105.0.0" targetFramework="net40" />
+  <package id="System.Linq.Dynamic" version="1.0.4" targetFramework="net40" />
+  <package id="Topshelf" version="3.1.4" targetFramework="net40" />
 </packages>

TimberWix/TimberWinR.Wix.wixproj

@@ -63,9 +63,6 @@
     </WixExtension>
   </ItemGroup>
   <Import Project="$(WixTargetsPath)" />
-  <PropertyGroup>
-    <PreBuildEvent />
-  </PropertyGroup>
   <Target Name="BeforeBuild">
     <!-- Read the version from the to-be-installed .exe -->
     <GetAssemblyIdentity AssemblyFiles="..\TimberWinR.ServiceHost\bin\$(Configuration)\TimberWinR.ServiceHost.exe">
@@ -101,7 +98,12 @@
     </CreateProperty>
   </Target>
   <PropertyGroup>
-    <PostBuildEvent>$(SolutionDir)\TimberWinR.ExtractID\$(OutDir)\TimberWinR.ExtractID.exe $(TargetDir) $(SolutionDir)chocolateyUninstall.ps1.guid  $(SolutionDir)chocolateyUninstall.ps1.template</PostBuildEvent>
+    <PreBuildEvent>mkdir  $(SolutionDir)tools
+cmd.exe /c copy $(SolutionDir)chocolateyUninstall.ps1.template.orig  $(SolutionDir)chocolateyUninstall.ps1.template</PreBuildEvent>
+  </PropertyGroup>
+  <PropertyGroup>
+    <PostBuildEvent>$(SolutionDir)\TimberWinR.ExtractID\$(OutDir)\TimberWinR.ExtractID.exe $(TargetDir) $(SolutionDir)chocolateyUninstall.ps1.guid  $(SolutionDir)chocolateyUninstall.ps1.template
+cmd.exe /c copy "$(TargetDir)%2a.msi" "$(SolutionDir)tools"</PostBuildEvent>
   </PropertyGroup>
   <!--
 	To modify your build process, add your task inside one of the targets below and uncomment it.

chocolateyInstall.ps1.template

@@ -1,8 +1,14 @@
 $packageName = 'TimberWinR-${version}' 
-$installerType = 'msi'
-$url = 'http://www.ericfontana.com/TimberWinR/TimberWinR-${version}.0.msi'
+$fileType = 'msi'
 $silentArgs = '/quiet' 
-$validExitCodes = @(0)
-Install-ChocolateyPackage "$packageName" "$installerType" "$silentArgs" "$url" "$url64"  -validExitCodes $validExitCodes
+$scriptPath =  $(Split-Path $MyInvocation.MyCommand.Path)
+$fileFullPath = Join-Path $scriptPath 'TimberWinR-${version}'
+try { 
+  Install-ChocolateyInstallPackage $packageName $fileType $silentArgs $fileFullPath
+} catch {
+  Write-ChocolateyFailure $packageName $($_.Exception.Message)
+  throw 
+}
+
 
 

chocolateyUninstall.ps1.template

@@ -1,8 +1,9 @@
 $packageName = 'TimberWinR-${version}' # arbitrary name for the package, used in messages
 $installerType = 'msi' #only one of these: exe, msi, msu
-$url = 'http://www.ericfontana.com/TimberWinR/TimberWinR-${version}.0.msi' # download url
+$scriptPath =  $(Split-Path $MyInvocation.MyCommand.Path)
+$fileFullPath = Join-Path $scriptPath 'TimberWinR-${version}'
 $silentArgs = '${PROJECTGUID} /quiet' 
 $validExitCodes = @(0) #please insert other valid exit codes here, exit codes for ms http://msdn.microsoft.com/en-us/library/aa368542(VS.85).aspx
-UnInstall-ChocolateyPackage "$packageName" "$installerType" "$silentArgs" "$url" -validExitCodes $validExitCodes
+UnInstall-ChocolateyPackage "$packageName" "$installerType" "$silentArgs" "fileFullPath" -validExitCodes $validExitCodes
 
 

chocolateyUninstall.ps1.template.orig

@@ -0,0 +1,7 @@
+$packageName = 'TimberWinR-${version}' # arbitrary name for the package, used in messages
+$installerType = 'msi' #only one of these: exe, msi, msu
+$scriptPath =  $(Split-Path $MyInvocation.MyCommand.Path)
+$fileFullPath = Join-Path $scriptPath 'TimberWinR-${version}'
+$silentArgs = '${PROJECTGUID} /quiet' 
+$validExitCodes = @(0) #please insert other valid exit codes here, exit codes for ms http://msdn.microsoft.com/en-us/library/aa368542(VS.85).aspx
+UnInstall-ChocolateyPackage "$packageName" "$installerType" "$silentArgs" "fileFullPath" -validExitCodes $validExitCodes

packages/MaxMind.DB.0.2.3.0/lib/net40/MaxMind.Db.xml

@@ -1,279 +0,0 @@
-<?xml version="1.0"?>
-<doc>
-    <assembly>
-        <name>MaxMind.Db</name>
-    </assembly>
-    <members>
-        <member name="T:MaxMind.Db.ObjectType">
-            <summary>
-            Enumeration representing the types of objects read from the database
-            </summary>
-        </member>
-        <member name="T:MaxMind.Db.Result">
-            <summary>
-            A data structure to store an object read from the database
-            </summary>
-        </member>
-        <member name="M:MaxMind.Db.Result.#ctor(Newtonsoft.Json.Linq.JToken,System.Int32)">
-            <summary>
-            Initializes a new instance of the <see cref="T:MaxMind.Db.Result"/> class.
-            </summary>
-            <param name="node">The node.</param>
-            <param name="offset">The offset.</param>
-        </member>
-        <member name="P:MaxMind.Db.Result.Node">
-            <summary>
-            The object read from the database
-            </summary>
-        </member>
-        <member name="P:MaxMind.Db.Result.Offset">
-            <summary>
-            The offset
-            </summary>
-        </member>
-        <member name="T:MaxMind.Db.Decoder">
-            <summary>
-            Given a stream, this class decodes the object graph at a particular location
-            </summary>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.#ctor(System.Threading.ThreadLocal{System.IO.Stream},System.Int32)">
-            <summary>
-            Initializes a new instance of the <see cref="T:MaxMind.Db.Decoder"/> class.
-            </summary>
-            <param name="stream">The stream.</param>
-            <param name="pointerBase">The base address in the stream.</param>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.Decode(System.Int32)">
-            <summary>
-            Decodes the object at the specified offset.
-            </summary>
-            <param name="offset">The offset.</param>
-            <returns>An object containing the data read from the stream</returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.ReadOne(System.Int32)">
-            <summary>
-            Reads the one.
-            </summary>
-            <param name="position">The position.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.ReadMany(System.Int32,System.Int32)">
-            <summary>
-            Reads the many.
-            </summary>
-            <param name="position">The position.</param>
-            <param name="size">The size.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeByType(MaxMind.Db.ObjectType,System.Int32,System.Int32)">
-            <summary>
-            Decodes the type of the by.
-            </summary>
-            <param name="type">The type.</param>
-            <param name="offset">The offset.</param>
-            <param name="size">The size.</param>
-            <returns></returns>
-            <exception cref="T:System.Exception">Unable to handle type!</exception>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.FromControlByte(System.Byte)">
-            <summary>
-            Froms the control byte.
-            </summary>
-            <param name="b">The attribute.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.SizeFromCtrlByte(System.Byte,System.Int32)">
-            <summary>
-            Sizes from control byte.
-            </summary>
-            <param name="ctrlByte">The control byte.</param>
-            <param name="offset">The offset.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeBoolean(System.Int32)">
-            <summary>
-            Decodes the boolean.
-            </summary>
-            <param name="size">The size of the structure.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeDouble(System.Byte[])">
-            <summary>
-            Decodes the double.
-            </summary>
-            <param name="buffer">The buffer.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeFloat(System.Byte[])">
-            <summary>
-            Decodes the float.
-            </summary>
-            <param name="buffer">The buffer.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeString(System.Byte[])">
-            <summary>
-            Decodes the string.
-            </summary>
-            <param name="buffer">The buffer.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeMap(System.Int32,System.Int32)">
-            <summary>
-            Decodes the map.
-            </summary>
-            <param name="size">The size.</param>
-            <param name="offset">The offset.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeLong(System.Byte[])">
-            <summary>
-            Decodes the long.
-            </summary>
-            <param name="buffer">The buffer.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeIntegerToJValue(System.Byte[])">
-            <summary>
-            Decodes the integer.
-            </summary>
-            <param name="buffer">The buffer.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeArray(System.Int32,System.Int32)">
-            <summary>
-            Decodes the array.
-            </summary>
-            <param name="size">The size.</param>
-            <param name="offset">The offset.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeUInt64(System.Byte[])">
-            <summary>
-            Decodes the uint64.
-            </summary>
-            <param name="buffer">The buffer.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeBigInteger(System.Byte[])">
-            <summary>
-            Decodes the big integer.
-            </summary>
-            <param name="buffer">The buffer.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodePointer(System.Int32,System.Int32,System.Int32@)">
-            <summary>
-            Decodes the pointer.
-            </summary>
-            <param name="ctrlByte">The control byte.</param>
-            <param name="offset">The offset.</param>
-            <param name="outOffset">The resulting offset</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeInteger(System.Byte[])">
-            <summary>
-            Decodes the integer.
-            </summary>
-            <param name="buffer">The buffer.</param>
-            <returns></returns>
-        </member>
-        <member name="M:MaxMind.Db.Decoder.DecodeInteger(System.Int32,System.Byte[])">
-            <summary>
-            Decodes the integer.
-            </summary>
-            <param name="baseValue">The base value.</param>
-            <param name="buffer">The buffer.</param>
-            <returns></returns>
-        </member>
-        <member name="T:MaxMind.Db.InvalidDatabaseException">
-            <summary>
-            Thrown when the MaxMind database file is incorrectly formatted
-            </summary>
-        </member>
-        <member name="M:MaxMind.Db.InvalidDatabaseException.#ctor(System.String)">
-            <summary>
-            Initializes a new instance of the <see cref="T:MaxMind.Db.InvalidDatabaseException"/> class.
-            </summary>
-            <param name="message">A message that describes the error.</param>
-        </member>
-        <member name="M:MaxMind.Db.InvalidDatabaseException.#ctor(System.String,System.Exception)">
-            <summary>
-            Initializes a new instance of the <see cref="T:MaxMind.Db.InvalidDatabaseException"/> class.
-            </summary>
-            <param name="message">The error message that explains the reason for the exception.</param>
-            <param name="innerException">The exception that is the cause of the current exception. If the <paramref name="innerException"/> parameter is not a null reference, the current exception is raised in a catch block that handles the inner exception.</param>
-        </member>
-        <member name="T:MaxMind.Db.FileAccessMode">
-            <summary>
-            An enumeration specifying the API to use to read the database
-            </summary>
-        </member>
-        <member name="F:MaxMind.Db.FileAccessMode.MemoryMapped">
-            <summary>
-            Open the file in memory mapped mode. Does not load into real memory.
-            </summary>
-        </member>
-        <member name="F:MaxMind.Db.FileAccessMode.Memory">
-            <summary>
-            Load the file into memory.
-            </summary>
-        </member>
-        <member name="T:MaxMind.Db.Reader">
-            <summary>
-            Given a MaxMind DB file, this class will retrieve information about an IP address
-            </summary>
-        </member>
-        <member name="M:MaxMind.Db.Reader.#ctor(System.String)">
-            <summary>
-            Initializes a new instance of the <see cref="T:MaxMind.Db.Reader"/> class.
-            </summary>
-            <param name="file">The file.</param>
-        </member>
-        <member name="M:MaxMind.Db.Reader.#ctor(System.String,MaxMind.Db.FileAccessMode)">
-            <summary>
-            Initializes a new instance of the <see cref="T:MaxMind.Db.Reader"/> class.
-            </summary>
-            <param name="file">The MaxMind DB file.</param>
-            <param name="mode">The mode by which to access the DB file.</param>
-        </member>
-        <member name="M:MaxMind.Db.Reader.#ctor(System.IO.Stream)">
-            <summary>
-            Initialize with Stream
-            </summary>
-            <param name="stream"></param>
-        </member>
-        <member name="M:MaxMind.Db.Reader.Find(System.String)">
-            <summary>
-            Finds the data related to the specified address.
-            </summary>
-            <param name="ipAddress">The IP address.</param>
-            <returns>An object containing the IP related data</returns>
-        </member>
-        <member name="M:MaxMind.Db.Reader.Find(System.Net.IPAddress)">
-            <summary>
-            Finds the data related to the specified address.
-            </summary>
-            <param name="ipAddress">The IP address.</param>
-            <returns>An object containing the IP related data</returns>
-        </member>
-        <member name="M:MaxMind.Db.Reader.Dispose">
-            <summary>
-            Release resources back to the system.
-            </summary>
-        </member>
-        <member name="P:MaxMind.Db.Reader.Metadata">
-            <summary>
-            Gets the metadata.
-            </summary>
-            <value>
-            The metadata.
-            </value>
-        </member>
-        <member name="T:MaxMind.Db.Metadata">
-            <summary>
-            Data about the database file itself
-            </summary>
-        </member>
-    </members>
-</doc>