Nagios Support Forum

Code: Select all

if [type] == "eventlog" {
   grok {
      match => ["Hostname", "%{WORD:Hostname}"]
      overwrite => ["Hostname"]
    }
    date {
       match => ["EventTime", "YYYY-MM-dd HH:mm:ss"]
      }
}
if [type] == "dmz-eventlog" {
   grok {
      match => ["Hostname", "%{WORD:Hostname}"]
      overwrite => ["Hostname"]
      add_tag => ["Event Log"]
    }
    date {
       match => ["EventTime", "YYYY-MM-dd HH:mm:ss"]
      }
}

Code: Select all

tcp {
    type => 'eventlog'
    port => 3515
    tags => 'Event Log'
    codec => json {
        charset => 'CP1252'
    }
}

Code: Select all

#This DEFINES the ROOT folder nxlog is installed into
define ROOT D:\nxlog
define CERT D:\nxlog\cert

Moduledir D:\nxlog\modules
CacheDir D:\nxlog\cachedata
Pidfile D:\nxlog\data\nxlog.pid
SpoolDir D:\nxlog\spooldata
LogFile D:\nxlog\data\nxlog.log

<Extension json>
    Module      xm_json
</Extension>

# Windows Event Log
<Input eventlog>
# Uncomment im_msvistalog for Windows Vista/2008 and later
    Module im_msvistalog

Query <QueryList> \
<Query Id="0">\
<Select Path="Application">*</Select>\
<Select Path="System">*</Select>\
<Select Path="Security">*</Select>\
<Select Path="Setup">*</Select>\
<Select Path="ForwardedEvents">*</Select>\
</Query>\
</QueryList>

# Uncomment im_mseventlog for Windows XP/2000/2003
#   Module im_mseventlog
</Input>

<Processor buffer>
    Module      pm_buffer
    MaxSize	1900000
    Type	Mem
    WarnLimit	1572864
</Processor>

<Processor diskbuffer>
    Module  pm_buffer
    MaxSize 3145728
    Type    Disk
    File    "D:\nxlog\buffer"
    WarnLimit   2097152
</Processor>

<Output out>
    Module om_tcp
    Host 10.242.102.108
    Port 3515

    Exec  $tmpmessage = $Message; delete($Message); rename_field("tmpmessage","message");
    Exec  $raw_event = to_json();

	# Uncomment for debug output
	# Exec file_write('%ROOT%\data\nxlog_output.log', $raw_event + "\n");
</Output>

<Route 1>
#  Path eventlog => diskbuffer => buffer => out
  Path eventlog => out
</Route>