GELF TCP and RAW TCP - NXLOG and GRAYLOG

[Malcolm]

Hi,

I’m using graylog 5.0.6 on Debian 11. I want to collect allf of the eventlog from a Windows server.
I installed the nxlog community agent on it.

If I configure my Input on “RAW TCP” I’m collecting a lot of informations. If I change the “RAW TCP” to “GELF TCP”, I’m collecting some information but not much as the RAW configuration. Do you know why ?
If I configure the GELF “UDP”, I’m collecting the same information than with “RAW” but the format is better.

I have to collect informations with TCP/TLS. All is work with RAW but not with GELF.

Why ?
I have to set others stuff inside the nxlog.conf ?

This is an exemple of my nxlog.conf (without TLS) :

Module om_tcp
Host my-graylog
Port 4515
OutputType GELF
Exec to_syslog_snare

Thanks!
Malcolm

[Joel_Duffield]

Have a look at this example NXlog config, and see if matching its settings helps the issue Sample NXLog Windows Collection configuration

[Malcolm]

YES!
It works, thank you.

Regards,
Malcolm