I'm looking for a good configuration that sends most System, Application and Security events to an output. I would have thought this configuration would work, but it seems that I get no logs from Security at all:

define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension json>
    Module xm_json
<Input eventlog>
    Module      im_msvistalog
    Query   <QueryList>\
        <Query Id="0">\
            <Select Path="Security">*</Select>\
            <Select Path="System">*[System/Level=4]</Select>\
            <Select Path="Application">*[Application/Level=4]</Select>\
            <Select Path="Setup">*[System/Level=4]</Select>\
            <Select Path='Windows PowerShell'>*</Select>\
    Exec        to_json();
<Output logstash_eventlog>
    Module      om_tcp
    Host        logstash
    Port        1935
<Route 1>
    Path        eventlog => logstash_eventlog

Meanwhile, nxlog.log doesn't state any obvious problems, connecting to logstash successfully. I turn on internal logging in nxlog to be sent and every single line there is successfully sent.

How do I ship Windows logs successfully with nxlog, is the question?

  • Have you tried it without the Query to see if eventlogs are read at all? – b0ti Feb 8 '14 at 14:25
  • Can you use the query to search using Event Viewer? (This being a useful way to build the query in the first place). – Cameron Kerr Jun 8 '15 at 2:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.