Help adding IIS Dashboard from the addon section?

[Abemiller]

Kinda noobish question - but while I can add the dashboard json file, I don't know where/how I am supposed to add the supporting files defining the cs-methods and whatnot. Site only says, "These must be added to your systems where appropriate before the dashboard will operate properly." and I've searched the heck out of this site and google for directions on customizing the NLA dashboards.

Help?

[tmcdonald]

NXLog configs, Log Server inputs and filters, and additional queries are also attached below.

The NXLog configs go on the remote machine where you have IIS running, and tell the NXLog service where to ship the IIS logs: https://support.nagios.com/kb/export.ph ... PDF&id=488

The inputs and filters are added under the Administration -> Global Configuration menu: https://assets.nagios.com/downloads/nag ... ilters.pdf

Queries are loaded on the same page where you view the dashboard: https://assets.nagios.com/downloads/nag ... Server.pdf (Page 3)

[Abemiller]

Thanks!
I was able to load the queries, but I notice the field names in the dashboard json need to be updated. However, I can't find how to edit the current dashboard elements. It's set to editable, but I can't find how to get into the underlying json so I can correct it. (Also, looked into deleting and re-importing the dashboard, but it isn't listing with an 'x' to delete next to it..)

[hsmith]

Can you post a screenshot of what you need edited?

[Abemiller]

When I inspect the query it shows it looking for data in "webserver.raw" but that data field is empty everywhere. I do have a 'webserver' field that is populated, but I can't seem to get the dashboard queries to look at that field.. they seem to want their raw versions.

Am I missing some global variable or something?

elastic-edit.PNG

[hsmith]

I believe a raw version of the field should have been created by default. Silly question, but you reloaded the NXLog service after adding the configuration, right?

[Abemiller]

Yep - in our poc I always stop the service, update the nxlog config, and restart service.
But yes, raw logs are empty - or appear so when I add that column in the search result boxes...

Here' what I have configured now in the NSlog.conf for the server I'm using to push IIS logs I copy over... :
# Watch your IIS log files
<Input iis_log1>
Module im_file
File 'C:\webX\\*.log'
SavePos FALSE
ReadFromLast FALSE
Exec $Message = $raw_event;
</Input>


<Output out>
Module om_tcp
Host nagiosLS1.internal.com
Port 3515

Exec $tmpmessage = $Message; delete($Message); rename_field("tmpmessage","message");
Exec $raw_event = to_json();

# Uncomment the below AND the fileop extension at top for debug output
#Exec file_write('%ROOT%\data\nxlog_output.log', $raw_event + "\n");
</Output>

[hsmith]

Did you ever copy this information into your NXLog config?

https://exchange.nagios.org/components/ ... 8&cf_id=36

[Abemiller]

No, didn't add the the w3c extension of the extra csv parsing. When I first tried, I used that, but nothing was coming over on the other side... before figuring out the cause we switched to using just the matching in the nls filter.

OK - so I'll correct.

That said, is there a resource or a standard framework I can reference on how the dashboards are coded?

[hsmith]

We do not have anything official. There is this document from Elastic that's about as close as I can find. As you're not a customer, I cannot offer a remote session to look at this, but I can suggest you sign up for a Nagios Log Server Quickstart.