nxlog config file

Posted on 2014-10-22
Last Modified: 2014-11-05
How do I modify the nxlog config file to send all IIS logs in JSON format?

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
# Include your Loggly Customer Token here
define CUSTOMER_TOKEN 111111111-111111-11111-1111-1111111111

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension syslog>
     Module xm_syslog
<Extension json>
     Module xm_json
<Extension w3c>
    Module      xm_csv
	Fields	$date, $time, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $cs(User-Agent), $sc-status, $sc-substatus, $sc-win32-status, $time-taken
    FieldTypes  string, string, string, string, string, string, string, string, string, string, string, string, string, string
    Delimiter	' '
#Feel free to add a selection for Setup and Application events below.
<Input in>
     Module im_msvistalog
     Query  <QueryList>\
                <Query Id="0">\
					 <Select Path="Application">*</Select>\
                     <Select Path="System">*</Select>\
                     <Select Path="Security">*</Select>\
					 <Suppress Path="Security">*[System[(EventID='4656') or (EventID='4658') or (EventID='5156') or (EventID='5158')]]</Suppress>\
     Exec $Message = " " + $EventID + ": " + $Message; \
 <Input iis>
    Module	im_file
    #Needs to be scoped to sane amount of files. Pointing to large amount of files is very inefficient because nxlog polls all logs every second
    File	'D:\\LogFiles\\W3SVC1\\u_ex*'
    ReadFromLast TRUE
    #Drop info legend lines
	Exec	if $raw_event =~ /^#/ drop();
#    Exec	if $raw_event =~ /^#/ drop();                    \
#			else                                             \
#			{                                                \
#				w3c->parse_csv();                            \
#				$EventTime = parsedate($date + " " + $time); \
#				to_json();									 \
#			}												 
<Output out>
     Module  om_tcp
     Port 514
	 # Be sure to replace <CUST_TOKEN> with your unique customer token
     # Any tags specified will be accessible within Loggly. Space separated list.
	 Exec to_syslog_ietf();\
$raw_event = replace($raw_event, 'NXLOG@14506', '%CUSTOMER_TOKEN%@41058 tag="webservers"] [', 1);
     #Use the following line for debugging (uncomment the fileop extension above as well)
     #Exec file_write("C:\\Program Files (x86)\\nxlog\data\\nxlog_output.log",  $raw_event);
<Route 1>
     Path in, iis => out

Open in new window

Question by:pzozulka
1 Comment
LVL 62

Accepted Solution

btan earned 500 total points
ID: 40398794
can you check out the below instead which shared briefly on using nxlog to read the IIS log and convert each line to JSON. The json ext is used
<Extension json>
    Module      xm_json

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Examines three attack vectors, specifically, the different types of malware used in malicious attacks, web application attacks, and finally, network based attacks.  Concludes by examining the means of securing and protecting critical systems and inf…
How do we balance the user experience (UX) with reasonable security measures? It can be done, if you keep these fundamentals in mind.
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

822 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question