NXLog is an open source tool that can convert log data into JSON for easy searching and analysis.
NXLog can be configured to write to a new log file, or to send data directly to InsightOps.
Installation and configuration
Download and install the latest version of NXLog. Follow the steps from the NXLog documentation here: (http://nxlog.co/products/nxlog-community-edition/download)
Installation folder requirements
Make sure to install NXLog locally and set the
ROOT to the folder in which it was installed. NXLog will not start if this installation requirement is not met.
Please see the NXLog reference manual about additional configuration options: http://nxlog.org/docs/
Once installed, open the NXLog configuration file located at:
C:\Program Files (x86)\nxlog\conf\nxlog.conf and paste this sample text into the file, adjusting the values for your account as necessary:
Sample configuration file:
1## This is a sample configuration file. See the nxlog reference manual about the2## configuration options. It should be installed locally and is also available3## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html45## Please set the ROOT to the folder your nxlog was installed into,6## otherwise it will not start.78#define ROOT C:\Program Files\nxlog9define ROOT C:\Program Files (x86)\nxlog1011Moduledir %ROOT%\modules12CacheDir %ROOT%\data13Pidfile %ROOT%\data\nxlog.pid14SpoolDir %ROOT%\data15LogFile %ROOT%\data\nxlog.log1617# Include fileop when rotating logs or while debugging, also enable in the output module below18#<Extension fileop>19# Module xm_fileop20#</Extension>2122# Create the parse rule for IIS logs. You can copy these from the header of the IIS log file.23<Extension w3c>24Module xm_csv25Fields $date, $time, $s_ip, $cs_method, $cs_uri_stem, $cs_uri_query, $s_port, $cs_username, $c_ip, $cs_User_Agent, $cs_Referer, $sc_status, $sc_substatus, $sc_win32_status, $time_taken26FieldTypes string, string, string, string, string, string, integer, string, string, string, string, integer, integer, integer, integer27Delimiter ' '28</Extension>2930<Extension json>31Module xm_json32</Extension>3334<Extension syslog>35Module xm_syslog36</Extension>3738<Input internal>39Module im_internal40Exec $Message = to_json();41</Input>4243<Input eventlog>44#This is the Windows Event Log Section - for 2008 and above use im_msvistalog - for 2003 and earlier, use im_mseventlog45#46Module im_msvistalog47# For windows 2003 and earlier use the following:48# Module im_mseventlog4950# Prepend the JSON event with the log token if you're sending directly to InsightOps51Exec $raw_event = "<LOG TOKEN GOES HERE>" + to_json();5253# If you're writing to a log file, then no need for the token54# Exec $raw_event = to_json();5556</Input>5758<Output eventlog_out>59# use this module to write to a text file that the agent can send in60#Module om_file61#file 'c:\test\eventlog.txt'62#Rotate created files63#<Schedule>64#Every 1 hour65#Exec file_cycle('c:\test\eventlog.txt', 2);66#Exec eventlog_out->reopen();67#</Schedule>6869# send log entries directly to InsightOps70Module om_tcp71Host ENDPOINT72Port PORT73</Output>747576<Route EventLog>77Path eventlog => eventlog_out78</Route>79
Set up the event source
- Log in to InsightOps.
- Click Add Data in the top navigation.
- Click Quick add.
- Create a new log by selecting Token TCP.
Record the token and endpoint for later
Take note of the token and endpoint that are displayed when the log is created. You will need this information to configure NXLog in the next step.
- Replace the contents of the
nxlog.conffile with the text in the sample configuration file.
- Replace the
<LOG TOKEN GOES HERE>string with the log token you noted earlier.
ENDPOINTwith the endpoint from the UI. For example, enter
REGIONis your region code, such as
10000for Token TCP.
- Restart the NXLog service by opening the services tool in the start menu. Search for NXLog in the services and then select Restart. This will restart NXLog and follow the new configuration.
If you find that the NXLog is not sending data, information can be found in the
nxlog file at
C:\\Program Files (x86)\\nxlog\\data\\nxlog.log.