Graylog Sidecar and static windows server .log files

[drsockmonkee (Andrew Davis)]

Hello I am trying to use GrayLog to parse and view logfiles from my Windows 2012 server.

I am unable to configure or alter the windows server, but I am able to export the log files and want to examine them.

I have configured my instance of GrayLog (2.0.3) on a VM (Ubuntu 16.04), running elasticsearch (2.3.1).

I have my log file in a folder inside my Ubuntu, and have my GrayLog Interface in showing in FireFox, and am trying to figure out how to connect the two. Trouble is, some documentation and the terms are outside my understanding and I am confused.

Question 1: Can I actually do this? (or am I very confused).
Question 2: Do I need Sidecar? I have attempted to install Sidecar but am unsure if it is correctly done.

Andy

[drsockmonkee (Andrew Davis)]

…
If I had not asked this, I never would have found this answer.

So, I started over. Downloaded the OVA device, and ran it. Before, I had tried to setup the stack in a stand alone VM (very much a newbie here)
http://docs.graylog.org/en/2.2/pages/installation/virtual_machine_appliances.html#virtual-machine-appliances

Then, I found this thread which helped a lot.

IIS logs into graylog

Finally got it working! Thanks to all that helped me out. define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Extension gelf> Module xm_gelf </Extension> <Extension fileop> Module xm_fileop </Extension> <Extension json> Module xm_json </Extension> Create the parse rule for IIS logs. You can copy these from the header of the IIS log file. <Extension w3c> M…

Thanks for the information people share here.

Andy