Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

nxlog config file

Posted on 2014-10-22
1
1,736 Views
Last Modified: 2014-11-05
How do I modify the nxlog config file to send all IIS logs in JSON format?

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
# Include your Loggly Customer Token here
define CUSTOMER_TOKEN 111111111-111111-11111-1111-1111111111

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension syslog>
     Module xm_syslog
 </Extension>
 
<Extension json>
     Module xm_json
 </Extension>
 
<Extension w3c>
    Module      xm_csv
	Fields	$date, $time, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $cs(User-Agent), $sc-status, $sc-substatus, $sc-win32-status, $time-taken
    FieldTypes  string, string, string, string, string, string, string, string, string, string, string, string, string, string
    Delimiter	' '
</Extension>
 
#Feel free to add a selection for Setup and Application events below.
 
<Input in>
     Module im_msvistalog
     Query  <QueryList>\
                <Query Id="0">\
					 <Select Path="Application">*</Select>\
                     <Select Path="System">*</Select>\
                     <Select Path="Security">*</Select>\
					 <Suppress Path="Security">*[System[(EventID='4656') or (EventID='4658') or (EventID='5156') or (EventID='5158')]]</Suppress>\
                </Query>\
          </QueryList>
     Exec $Message = " " + $EventID + ": " + $Message; \
		to_json();
 </Input>
 
 <Input iis>
    Module	im_file
    #Needs to be scoped to sane amount of files. Pointing to large amount of files is very inefficient because nxlog polls all logs every second
    File	'D:\\LogFiles\\W3SVC1\\u_ex*'
    ReadFromLast TRUE
    #Drop info legend lines
	Exec	if $raw_event =~ /^#/ drop();
#    Exec	if $raw_event =~ /^#/ drop();                    \
#			else                                             \
#			{                                                \
#				w3c->parse_csv();                            \
#				$EventTime = parsedate($date + " " + $time); \
#				to_json();									 \
#			}												 
			
</Input>
 
<Output out>
     Module  om_tcp
	 Host logs-01.loggly.com
     Port 514
	 # Be sure to replace <CUST_TOKEN> with your unique customer token
     # Any tags specified will be accessible within Loggly. Space separated list.
	 Exec to_syslog_ietf();\
$raw_event = replace($raw_event, 'NXLOG@14506', '%CUSTOMER_TOKEN%@41058 tag="webservers"] [', 1);
     #Use the following line for debugging (uncomment the fileop extension above as well)
     #Exec file_write("C:\\Program Files (x86)\\nxlog\data\\nxlog_output.log",  $raw_event);
 </Output>
 
<Route 1>
     Path in, iis => out
 </Route>

Open in new window

0
Comment
Question by:pzozulka
1 Comment
 
LVL 63

Accepted Solution

by:
btan earned 500 total points
ID: 40398794
can you check out the below instead which shared briefly on using nxlog to read the IIS log and convert each line to JSON. The json ext is used
<Extension json>
    Module      xm_json
</Extension>

http://forums.iis.net/post/2055838.aspx
http://nxlog-ce.sourceforge.net/nxlog-docs/en/nxlog-reference-manual.html#processing_parsers_w3c
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this increasingly digital world, security hacks are no longer just a threat, but a reality. As we've witnessed with Target's big identity hack 2013, Heartbleed in 2015, and now Cloudbleed, companies and their leaders need to prepare for the unthi…
As cyber crime continues to grow in both numbers and sophistication, a troubling trend of optimization has emerged over the last year.
Video by: Mark
This lesson goes over how to construct ordered and unordered lists and how to create hyperlinks.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question