nxlog config file

Posted on 2014-10-22
Last Modified: 2014-11-05
How do I modify the nxlog config file to send all IIS logs in JSON format?

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
# Include your Loggly Customer Token here
define CUSTOMER_TOKEN 111111111-111111-11111-1111-1111111111

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension syslog>
     Module xm_syslog
<Extension json>
     Module xm_json
<Extension w3c>
    Module      xm_csv
	Fields	$date, $time, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $cs(User-Agent), $sc-status, $sc-substatus, $sc-win32-status, $time-taken
    FieldTypes  string, string, string, string, string, string, string, string, string, string, string, string, string, string
    Delimiter	' '
#Feel free to add a selection for Setup and Application events below.
<Input in>
     Module im_msvistalog
     Query  <QueryList>\
                <Query Id="0">\
					 <Select Path="Application">*</Select>\
                     <Select Path="System">*</Select>\
                     <Select Path="Security">*</Select>\
					 <Suppress Path="Security">*[System[(EventID='4656') or (EventID='4658') or (EventID='5156') or (EventID='5158')]]</Suppress>\
     Exec $Message = " " + $EventID + ": " + $Message; \
 <Input iis>
    Module	im_file
    #Needs to be scoped to sane amount of files. Pointing to large amount of files is very inefficient because nxlog polls all logs every second
    File	'D:\\LogFiles\\W3SVC1\\u_ex*'
    ReadFromLast TRUE
    #Drop info legend lines
	Exec	if $raw_event =~ /^#/ drop();
#    Exec	if $raw_event =~ /^#/ drop();                    \
#			else                                             \
#			{                                                \
#				w3c->parse_csv();                            \
#				$EventTime = parsedate($date + " " + $time); \
#				to_json();									 \
#			}												 
<Output out>
     Module  om_tcp
     Port 514
	 # Be sure to replace <CUST_TOKEN> with your unique customer token
     # Any tags specified will be accessible within Loggly. Space separated list.
	 Exec to_syslog_ietf();\
$raw_event = replace($raw_event, 'NXLOG@14506', '%CUSTOMER_TOKEN%@41058 tag="webservers"] [', 1);
     #Use the following line for debugging (uncomment the fileop extension above as well)
     #Exec file_write("C:\\Program Files (x86)\\nxlog\data\\nxlog_output.log",  $raw_event);
<Route 1>
     Path in, iis => out

Open in new window

Question by:pzozulka
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
LVL 64

Accepted Solution

btan earned 500 total points
ID: 40398794
can you check out the below instead which shared briefly on using nxlog to read the IIS log and convert each line to JSON. The json ext is used
<Extension json>
    Module      xm_json

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
Recovering from what the press called "the largest-ever cyber-attack", IT departments worldwide are discussing ways to defend against this in the future. In this process, many people are looking for immediate actions while, instead, they need to tho…
Learn how to create flexible layouts using relative units in CSS.  New relative units added in CSS3 include vw(viewports width), vh(viewports height), vmin(minimum of viewports height and width), and vmax (maximum of viewports height and width).
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question