# Sample NXLog Windows Collection configuration

**URL:** <https://community.graylog.org/t/sample-nxlog-windows-collection-configuration/28514>\
**Category:** Graylog Central (peer support)\
**Created:** [April 20, 2023, 5:32pm UTC](https://community.graylog.org/t/sample-nxlog-windows-collection-configuration/28514 "2023-04-20T17:32:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![joe.gross](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/joe.gross/32/13372_2.png) [@joe.gross](https://community.graylog.org/u/joe.gross)\
**Post date:** [April 20, 2023, 5:32pm UTC](https://community.graylog.org/t/sample-nxlog-windows-collection-configuration/28514/1 "2023-04-20T17:32:54Z")

</div>

Posted for future reference:

```auto
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

<Extension logrotate>
    Module xm_fileop
    <Schedule>
        When @daily
        Exec file_cycle('%ROOT%\data\nxlog.log', 7);
     </Schedule>
</Extension>

<Extension gelfExt>
  Module xm_gelf
  # Avoid truncation of the short_message field to 64 characters.
  ShortMessageLength 65536
</Extension>

<Input eventlog>
        Module im_msvistalog
        PollInterval 1
        SavePos True
        ReadFromLast True
        
        #Channel System
        #<QueryXML>
        # <QueryList>
        # <Query Id='1'>
        # <Select Path='Security'>*[System/Level=4]</Select>
        # </Query>
        # </QueryList>
        #</QueryXML>
</Input>

<Input file>
	Module im_file
	File 'C:\Windows\MyLogDir\\*.log'
	PollInterval 1
	SavePos	True
	ReadFromLast True
	Recursive False
	RenameCheck False
	Exec $FileName = file_name(); # Send file name with each message
</Input>

<Output gelf>
	Module om_tcp
	Host 192.168.1.1
	Port 12201
	OutputType GELF_TCP
	<Exec>
	  # These fields are needed for Graylog
	  $gl2_source_collector = '${sidecar.nodeId}';
	  $collector_node_id = '${sidecar.nodeName}';
	</Exec>
</Output>

<Route route-1>
  Path eventlog => gelf
</Route>
<Route route-2>
  Path file => gelf
</Route>

```

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [April 21, 2023, 9:26pm UTC](https://community.graylog.org/t/sample-nxlog-windows-collection-configuration/28514/2 "2023-04-21T21:26:59Z")

</div>

Hey @joe.gross

Is this configuration mainly used with Graylog Sidecar? The reason I ask is that I have old config Ive been using since Graylog 2.4.  
GELF-TCP/TLS

```auto
## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/docs/

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
define LOGFILE C:\Program Files (x86)\nxlog\data\nxlog.log

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
#LogLevel DEBUG

<Extension _fileop>
    Module xm_fileop
    # Check the log file size every hour and rotate if larger than 5 MB
    <Schedule>
        Every 1 hour
        <Exec>
            if (file_exists('%LOGFILE%') and file_size('%LOGFILE%') >= 5M)
                file_cycle('%LOGFILE%', 8);
        </Exec>
    </Schedule>
    # Rotate log file every week on Sunday at midnight
    <Schedule>
        When @weekly
        Exec if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
    </Schedule>
</Extension>

<Extension gelf>
    Module xm_gelf
 </Extension>

<Input zone-01>
    Module im_msvistalog
    Query <QueryList>\
           <Query Id="0">\
               <Select Path="Application">*</Select>\
               <Select Path="System">*</Select>\
               <Select Path="Security">*</Select>\    
             </Query>\
    </QueryList>  
</Input>

<Output out>
    Module om_ssl 
    Host graylog.domain.com
    Port 51412
    OutputType GELF_TCP 
    CertFile %CERTDIR%/graylog3-certificate.pem
    CertKeyFile %CERTDIR%/graylog3-key.pem
    CAFile %CERTDIR%/cert3.pem
    KeyPass secret 
    AllowUntrusted true   
    Exec $Hostname = hostname_fqdn();
    Exec $FullMessage = $raw_event;    
</Output>

<Route >
    Path zone-01 => out
</Route>

```

---

<div class="post-metadata">

**Author:** ![joe.gross](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/joe.gross/32/13372_2.png) [@joe.gross](https://community.graylog.org/u/joe.gross)\
**Post date:** [April 21, 2023, 9:47pm UTC](https://community.graylog.org/t/sample-nxlog-windows-collection-configuration/28514/3 "2023-04-21T21:47:59Z")

</div>

Not specifically sidecar. It’s just a minimum configuration to get it to output GELF.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 5, 2023, 9:48pm UTC](https://community.graylog.org/t/sample-nxlog-windows-collection-configuration/28514/4 "2023-05-05T21:48:32Z")

</div>

Closed on May 5, 2023, 9:48pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.