I'm looking for a good configuration that sends most System, Application and Security events to an output. I would have thought this configuration would work, but it seems that I get no logs from Security at all:
define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Extension json> Module xm_json </Extension> <Input eventlog> Module im_msvistalog Query <QueryList>\ <Query Id="0">\ <Select Path="Security">*</Select>\ <Select Path="System">*[System/Level=4]</Select>\ <Select Path="Application">*[Application/Level=4]</Select>\ <Select Path="Setup">*[System/Level=4]</Select>\ <Select Path='Windows PowerShell'>*</Select>\ </Query>\ </QueryList> Exec to_json(); </Input> <Output logstash_eventlog> Module om_tcp Host logstash Port 1935 </Output> <Route 1> Path eventlog => logstash_eventlog </Route>
Meanwhile, nxlog.log doesn't state any obvious problems, connecting to logstash successfully. I turn on internal logging in nxlog to be sent and every single line there is successfully sent.
How do I ship Windows logs successfully with nxlog, is the question?