Nxlog config with index

Graylog Central (peer support)
1

Hi,

I am trying to push my client server logs with nxlog to graylog as a index not with default index.

Is there any config issue with nxlog

User nxlog
Group nxlog

LogFile /var/log/nxlog/nxlog.log
LogLevel INFO

########################################
# Modules                              #
########################################
<Extension gelf>
    Module      xm_gelf
</Extension>

<Input in>
        Module  im_file
        File    "/var/log/test/test.log"
</Input>

<Output out>
    Module      om_tcp
    Host        x.x.x.x
    Port        12201
    OutputType  GELF_TCP
    index => "test-%{+YYYY.MM.dd}"
</Output>

########################################
# Routes                               #
########################################
<Route r>
    Path        in => out
</Route>
2

Please elaborate on what you’re trying to achieve and post the complete configuration of all relevant components such as the configuration of the inputs in Graylog.

3

I am trying create index in nxlog.conf, want to push my logs to defined index not with default index,
we have multiple clients depends on index we are going to push logs based on index will search the logs.

4

Neither NXLOG nor Graylog do support that in the way you intend it to work.

If you want to store messages in a different index (or index set), you’ll have to do this in Graylog using stream rules or pipeline rules:

5

Is there any possibility with filebeat with graylog

6

Yes, Filebeat (or any log shipper supporting the Beats protocol) can be used with Graylog.

You could manually build the functionality to specify the target index in Filebeat, e. g. by using a custom message field which a pipeline rule in Graylog is using to identify the stream in which a message should be placed.

7

what is the syntax to configure in filebeat either nxlog as a stream input.
if you have any conf file, please share

8

I won’t give you a copy & paste ready solution, but the general procedure would be the following:

9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.