nxlog config file

Posted on 2014-10-22
Medium Priority
Last Modified: 2014-11-05
How do I modify the nxlog config file to send all IIS logs in JSON format?

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
# Include your Loggly Customer Token here
define CUSTOMER_TOKEN 111111111-111111-11111-1111-1111111111

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension syslog>
     Module xm_syslog
<Extension json>
     Module xm_json
<Extension w3c>
    Module      xm_csv
	Fields	$date, $time, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $cs(User-Agent), $sc-status, $sc-substatus, $sc-win32-status, $time-taken
    FieldTypes  string, string, string, string, string, string, string, string, string, string, string, string, string, string
    Delimiter	' '
#Feel free to add a selection for Setup and Application events below.
<Input in>
     Module im_msvistalog
     Query  <QueryList>\
                <Query Id="0">\
					 <Select Path="Application">*</Select>\
                     <Select Path="System">*</Select>\
                     <Select Path="Security">*</Select>\
					 <Suppress Path="Security">*[System[(EventID='4656') or (EventID='4658') or (EventID='5156') or (EventID='5158')]]</Suppress>\
     Exec $Message = " " + $EventID + ": " + $Message; \
 <Input iis>
    Module	im_file
    #Needs to be scoped to sane amount of files. Pointing to large amount of files is very inefficient because nxlog polls all logs every second
    File	'D:\\LogFiles\\W3SVC1\\u_ex*'
    ReadFromLast TRUE
    #Drop info legend lines
	Exec	if $raw_event =~ /^#/ drop();
#    Exec	if $raw_event =~ /^#/ drop();                    \
#			else                                             \
#			{                                                \
#				w3c->parse_csv();                            \
#				$EventTime = parsedate($date + " " + $time); \
#				to_json();									 \
#			}												 
<Output out>
     Module  om_tcp
	 Host logs-01.loggly.com
     Port 514
	 # Be sure to replace <CUST_TOKEN> with your unique customer token
     # Any tags specified will be accessible within Loggly. Space separated list.
	 Exec to_syslog_ietf();\
$raw_event = replace($raw_event, 'NXLOG@14506', '%CUSTOMER_TOKEN%@41058 tag="webservers"] [', 1);
     #Use the following line for debugging (uncomment the fileop extension above as well)
     #Exec file_write("C:\\Program Files (x86)\\nxlog\data\\nxlog_output.log",  $raw_event);
<Route 1>
     Path in, iis => out

Open in new window

Question by:pzozulka
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
LVL 64

Accepted Solution

btan earned 2000 total points
ID: 40398794
can you check out the below instead which shared briefly on using nxlog to read the IIS log and convert each line to JSON. The json ext is used
<Extension json>
    Module      xm_json


Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as high-speed processing of the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Check out the latest tech news, community articles, and expert highlights in August's newsletter.
This month, Experts Exchange’s free Course of the Month is focused on CompTIA IT Fundamentals.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Suggested Courses

741 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question