Edit: This post is pretty old and Elasticsearch/Logstash/Kibana have evolved a lot since it was written.
Part 3 of 4 – Part 1 – Part 2 – Part 4
This is a continuation of http://www.ragingcomputer.com/2014/02/logstash-elasticsearch-kibana-for-windows-event-logs
Again, I took a lot of inspiration from http://sysxfit.com/blog/2013/07/18/logging-with-logstash-part-3/
The nxlog reference manual is surprisingly well written with excellent examples.
Loggly has some examples I found useful, even if I’m not using their service.
There are other options.
Download and run the windows installer. This is a very fast install.
Edit your nxlog.conf. Its location will depend on your OS.
C:\Program Files (x86)\nxlog\conf\nxlog.conf
Note: You will need to modify the Define ROOT depending on 32bit or 64bit install.
Note: You will need to modify the input eventlog section depending on windows version.
Note: You will need to modify Host in the Output section to the IP address or hostname of you logstash computer.
## Please set the ROOT to the folder your nxlog was installed into, ## otherwise it will not start. #define ROOT C:\Program Files\nxlog define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Extension json> Module xm_json </Extension> # Nxlog internal logs <Input internal> Module im_internal Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json(); </Input> # Windows Event Log <Input eventlog> # Uncomment im_msvistalog for Windows Vista/2008 and later Module im_msvistalog # Uncomment im_mseventlog for Windows XP/2000/2003 # Module im_mseventlog Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json(); </Input> <Output out> Module om_tcp Host 192.168.1.126 Port 3515 </Output> <Route 1> Path internal, eventlog => out </Route>
START NXLOG SERVICE
Finally, start the service. Either open computer management, open services, find nxlog in the list and start or from an administrator command prompt
net start nxlog
I’m kinda lazy and doing repetitive tasks by hand isn’t my cup of tea, so since I had 20 identical machines to install this on, I whipped up this bat file for installing it while I remotely connected for other maintenance.
@echo off echo installing nxlog msiexec /passive /i "\\shareserver\sharename\path\to\nxlog\nxlog-ce-2.6.1131.msi" echo copying configuration move "C:\Program Files\nxlog\conf\nxlog.conf" "C:\Program Files\nxlog\conf\nxlog.conf.default" copy "\\shareserver\sharename\path\to\nxlog\nxlog.conf" "C:\Program Files\nxlog\conf\nxlog.conf" echo starting service net start nxlog echo done