# \#nxlog **URL:** https://community.graylog.org/tag/nxlog/18.md [Latest](https://community.graylog.org/latest.md) · [Categories](https://community.graylog.org/categories.md) · [Tags](https://community.graylog.org/tags.md) --- ## [Why Graylog does not collect some logs from Windows Servers?](https://community.graylog.org/t/why-graylog-does-not-collect-some-logs-from-windows-servers/35932)
**Author:** [@alesblinka](https://community.graylog.org/u/alesblinka)\ **Replies:** 0\ **Last updated:** [July 2, 2025, 2:55pm UTC](https://community.graylog.org/t/why-graylog-does-not-collect-some-logs-from-windows-servers/35932 "2025-07-02T14:55:05Z")
Hi I use Graylog pretty well, it collects logs from my Linux even Windows servers. But I have found it does not collect everything from Windows. E.g. I can see all failure even successful logons are collected. Even new … --- ## [Filter logs by logon type](https://community.graylog.org/t/filter-logs-by-logon-type/35779)
**Author:** [@Ev4ld](https://community.graylog.org/u/Ev4ld)\ **Replies:** 0\ **Last updated:** [June 3, 2025, 1:41pm UTC](https://community.graylog.org/t/filter-logs-by-logon-type/35779 "2025-06-03T13:41:24Z")
I’m trying to filer out logs by logon type where I don’t want to receive logons with LogonType 5 and 3 with: \ Module im\_msvistalog \ \ \ … --- ## [Issues creating a buffer for with nxlog](https://community.graylog.org/t/issues-creating-a-buffer-for-with-nxlog/35308)
**Author:** [@jxnnis](https://community.graylog.org/u/jxnnis)\ **Replies:** 8\ **Last updated:** [March 26, 2025, 1:22pm UTC](https://community.graylog.org/t/issues-creating-a-buffer-for-with-nxlog/35308 "2025-03-26T13:22:31Z")
Hello All, Im using nxlog on my Windows Server 2022 to send security event logs to my graylog instance, which works totally fine itself with this nxlog config: I wanted to configure a buffer i thos config, so logs a… --- ## [Nxlog configuration for parsing server logs on graylog V1](https://community.graylog.org/t/nxlog-configuration-for-parsing-server-logs-on-graylog-v1/34860)
**Author:** [@AymanDeda](https://community.graylog.org/u/AymanDeda)\ **Replies:** 1\ **Last updated:** [February 6, 2025, 10:13am UTC](https://community.graylog.org/t/nxlog-configuration-for-parsing-server-logs-on-graylog-v1/34860 "2025-02-06T10:13:29Z")
Hello, im trying to configure my Nxlog in order to prase a server.log file in graylog. i managed so far to get the logs to show up in graylog but im encountering the problem, that when searching for some logs in graylog… --- ## [Can't connect graylog using nxlog](https://community.graylog.org/t/cant-connect-graylog-using-nxlog/34004)
**Author:** [@invokozen](https://community.graylog.org/u/invokozen)\ **Replies:** 1\ **Last updated:** [October 30, 2024, 10:59am UTC](https://community.graylog.org/t/cant-connect-graylog-using-nxlog/34004 "2024-10-30T10:59:32Z")
Need help, how to client connect to graylog Define the base configuration for NXLog Moduledir “C:\\Program Files (x86)\\nxlog\\modules” CacheDir “C:\\Program Files (x86)\\nxlog\\data” LogFile “C:\\Program Files (x86)\\nxlog\\d… --- ## [Nxlog to Graylog / Nxlog config](https://community.graylog.org/t/nxlog-to-graylog-nxlog-config/33770)
**Author:** [@drx1984](https://community.graylog.org/u/drx1984)\ **Replies:** 5\ **Last updated:** [October 14, 2024, 2:46pm UTC](https://community.graylog.org/t/nxlog-to-graylog-nxlog-config/33770 "2024-10-14T14:46:54Z")
I want to send the login and failure logs from my Windows systems to Graylog via NXLog. Can anyone tell me how to adjust the NXLog configuration to make this work? I’ve already tried using a configuration but I’m not get… --- ## [Cannot parse msg - xm\_kvp](https://community.graylog.org/t/cannot-parse-msg-xm-kvp/33819)
**Author:** [@Ivan1](https://community.graylog.org/u/Ivan1)\ **Replies:** 8\ **Last updated:** [October 11, 2024, 10:10am UTC](https://community.graylog.org/t/cannot-parse-msg-xm-kvp/33819 "2024-10-11T10:10:36Z")
Good afternoon I have a problem when using the module … The bottom line is that some messages get into the stream, some don’t. And I can’t figure out the reason why, I’m already giving up - I need your help! \ **Author:** [@fsv](https://community.graylog.org/u/fsv)\ **Replies:** 7\ **Last updated:** [October 8, 2024, 11:44am UTC](https://community.graylog.org/t/proccess-buffer-full-slow-output-journaling/33780 "2024-10-08T11:44:06Z") We are using Graylog 6.x on CentOS. This specific node has 24 CPUs and 24GB RAM on an SSD storage and is part of a 3 node Graylog cluster where each node is also a Mongo node. There is no load balancing in play here, … --- ## [NXLog drop() config for executing nxlog.exe](https://community.graylog.org/t/nxlog-drop-config-for-executing-nxlog-exe/33157)
**Author:** [@Marvin1](https://community.graylog.org/u/Marvin1)\ **Replies:** 2\ **Last updated:** [August 12, 2024, 6:04am UTC](https://community.graylog.org/t/nxlog-drop-config-for-executing-nxlog-exe/33157 "2024-08-12T06:04:34Z")
Hey Guys, I have the problem that NXLog send messages about executing nxlog.exe and dns.exe like this: The full message: { “Category”: “Filtering Platform Connection”, “gl2\_remote\_ip”: “10.X.X.X”, “gl2\_remote\_por… --- ## [Collecting Windows Logs with nxlog doesn´t work properly](https://community.graylog.org/t/collecting-windows-logs-with-nxlog-doesn-t-work-properly/32930)
**Author:** [@Zandah](https://community.graylog.org/u/Zandah)\ **Replies:** 3\ **Last updated:** [July 18, 2024, 7:48am UTC](https://community.graylog.org/t/collecting-windows-logs-with-nxlog-doesn-t-work-properly/32930 "2024-07-18T07:48:34Z")
I just tried to collect some Windows Logs from a Windows Server 2019. My Graylog Server is located on a ubuntu 22.04 machine. I did the same procedure as the youtube video suggested: https://www.youtube.com/watch?v=a3LbQ… --- ## [Nxlog sidecar collector and local nxlog service ARE able to run at the same time](https://community.graylog.org/t/nxlog-sidecar-collector-and-local-nxlog-service-are-able-to-run-at-the-same-time/32602)
**Author:** [@cesq](https://community.graylog.org/u/cesq)\ **Replies:** 2\ **Last updated:** [June 3, 2024, 1:02pm UTC](https://community.graylog.org/t/nxlog-sidecar-collector-and-local-nxlog-service-are-able-to-run-at-the-same-time/32602 "2024-06-03T13:02:21Z")
Looking at the documentation for setting up sidecar collectors and the docs state that before launching nxlog by graylog-sidecar you have to stop, disable and unconfigure the local nxlog instance: Because the Sidecar t… --- ## [Csv\_parser failing](https://community.graylog.org/t/csv-parser-failing/31940)
**Author:** [@jammin2night](https://community.graylog.org/u/jammin2night)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 3:10pm UTC](https://community.graylog.org/t/csv-parser-failing/31940 "2024-03-26T15:10:10Z")
Is cvs\_parser really a module? I would have thought it is a function withing the module im\_file ---- I am really new to nxlog but have it importing logs from other sources that are not cvs based - I have RTFM so obviousl… --- ## [NXlog to Graylog TLS/SSL Config File](https://community.graylog.org/t/nxlog-to-graylog-tls-ssl-config-file/31858)
**Author:** [@nickmayer](https://community.graylog.org/u/nickmayer)\ **Replies:** 0\ **Last updated:** [March 20, 2024, 10:47am UTC](https://community.graylog.org/t/nxlog-to-graylog-tls-ssl-config-file/31858 "2024-03-20T10:47:18Z")
Hello! I’ve had my fair share of troubles with securely sending Windows event logs to Graylog with NXlog and wanted to share what has worked for me. I know winlogbeat is the way to go nowadays but here’s to those who wa… --- ## [Nxlog configuration to log deleting objects on a Windows Server](https://community.graylog.org/t/nxlog-configuration-to-log-deleting-objects-on-a-windows-server/31708)
**Author:** [@Marvin1](https://community.graylog.org/u/Marvin1)\ **Replies:** 0\ **Last updated:** [March 5, 2024, 2:17pm UTC](https://community.graylog.org/t/nxlog-configuration-to-log-deleting-objects-on-a-windows-server/31708 "2024-03-05T14:17:00Z")
Hello Guys, I have a special use case, i want to monitor the Object handling on a windows server. I created a auditing job that work very well. A good guide is How to Audit File or Folder Deletion in Windows Server?. I… --- ## [Sending log from Android to Graylog](https://community.graylog.org/t/sending-log-from-android-to-graylog/30663)
**Author:** [@wilsonshow](https://community.graylog.org/u/wilsonshow)\ **Replies:** 2\ **Last updated:** [November 22, 2023, 5:34am UTC](https://community.graylog.org/t/sending-log-from-android-to-graylog/30663 "2023-11-22T05:34:35Z")
Would like to know if it is possible to send Android to Graylog? I had currently extract out the my Android log from logcat and save it as a text file. How will I be able to send over to my graylog server? In additional… --- ## [GELF Message validation - error has empty mandatory "short\_message" field](https://community.graylog.org/t/gelf-message-validation-error-has-empty-mandatory-short-message-field/30723)
**Author:** [@devender](https://community.graylog.org/u/devender)\ **Replies:** 1\ **Last updated:** [November 21, 2023, 5:29am UTC](https://community.graylog.org/t/gelf-message-validation-error-has-empty-mandatory-short-message-field/30723 "2023-11-21T05:29:08Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Graylog Pipeline rule](https://community.graylog.org/t/graylog-pipeline-rule/29892)
**Author:** [@abamus](https://community.graylog.org/u/abamus)\ **Replies:** 17\ **Last updated:** [September 12, 2023, 3:30pm UTC](https://community.graylog.org/t/graylog-pipeline-rule/29892 "2023-09-12T15:30:10Z")
1. Describe your incident: Hello, I am new to Graylog. I have deployed the server and i am receiving messages from endpoints. I am working on filtering messages to extract only certain fields in all messages drop the … --- ## [Pipeline Rule - converted numbers changed to zeros](https://community.graylog.org/t/pipeline-rule-converted-numbers-changed-to-zeros/8750)
**Author:** [@sapplega](https://community.graylog.org/u/sapplega)\ **Replies:** 24\ **Last updated:** [September 7, 2023, 10:23am UTC](https://community.graylog.org/t/pipeline-rule-converted-numbers-changed-to-zeros/8750 "2023-09-07T10:23:02Z")
I’m trying to create a pipeline rule to split a message containing comma seperated lines into individual fields. The first 3 fields are strings and work fine. The remaining three fields are converted to numbers, but al… --- ## [IIS logs in Graylog](https://community.graylog.org/t/iis-logs-in-graylog/29738)
**Author:** [@marshall](https://community.graylog.org/u/marshall)\ **Replies:** 1\ **Last updated:** [August 3, 2023, 5:11pm UTC](https://community.graylog.org/t/iis-logs-in-graylog/29738 "2023-08-03T17:11:34Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Nxlog event consistency](https://community.graylog.org/t/nxlog-event-consistency/29536)
**Author:** [@Jeff-Crowe](https://community.graylog.org/u/Jeff-Crowe)\ **Replies:** 8\ **Last updated:** [July 26, 2023, 7:59pm UTC](https://community.graylog.org/t/nxlog-event-consistency/29536 "2023-07-26T19:59:34Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [NXLOG GELF - Windows Event Logs XML not all values parsed / fields created](https://community.graylog.org/t/nxlog-gelf-windows-event-logs-xml-not-all-values-parsed-fields-created/29570)
**Author:** [@s0p4L1N](https://community.graylog.org/u/s0p4L1N)\ **Replies:** 1\ **Last updated:** [July 20, 2023, 5:03am UTC](https://community.graylog.org/t/nxlog-gelf-windows-event-logs-xml-not-all-values-parsed-fields-created/29570 "2023-07-20T05:03:19Z")
1. Describe your incident: I’m sending multiple windows security event to Graylog with NXLOG and I noticed that many of XML value / data was not parsed. For my case here, I’m sending Windwos Defender Events. I downloa… --- ## [NxLog Help - Logs Not Fully Ingesting](https://community.graylog.org/t/nxlog-help-logs-not-fully-ingesting/29361)
**Author:** [@a7ebouovue8v](https://community.graylog.org/u/a7ebouovue8v)\ **Replies:** 3\ **Last updated:** [June 30, 2023, 2:06am UTC](https://community.graylog.org/t/nxlog-help-logs-not-fully-ingesting/29361 "2023-06-30T02:06:51Z")
I’m attempting to ship Windows and App logs to Graylog via NxLog. I know it’s at least partially working because I’ll randomly receive logs in Graylog, but not all of them. I’m running Windows Server 2019 and I’m trying … --- ## [Graylog 5.0.6 Getting Some logs but not All](https://community.graylog.org/t/graylog-5-0-6-getting-some-logs-but-not-all/29199)
**Author:** [@cbryner](https://community.graylog.org/u/cbryner)\ **Replies:** 3\ **Last updated:** [June 22, 2023, 8:28am UTC](https://community.graylog.org/t/graylog-5-0-6-getting-some-logs-but-not-all/29199 "2023-06-22T08:28:09Z")
1. Describe your incident: Graylog Server gets some log messages but not all messages from a windows server Ex. We get login events but no messages from event id 5136. Event ID 5136 does show up in the windows event vi… --- ## [Import evtx-files from a directory to graylog](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196)
**Author:** [@itsjstin](https://community.graylog.org/u/itsjstin)\ **Replies:** 7\ **Last updated:** [June 18, 2023, 12:31am UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196 "2023-06-18T00:31:38Z")
Hello guys, I want to configure graylog sidecar to import WIndows-Event-Logs from a directory to graylog. Is it possible to use nxlog, filebeat or winlogbeat to import these logs? I tried some different configs but I do… --- ## [Inputs and configuration](https://community.graylog.org/t/inputs-and-configuration/28931)
**Author:** [@rooster](https://community.graylog.org/u/rooster)\ **Replies:** 5\ **Last updated:** [May 26, 2023, 4:56am UTC](https://community.graylog.org/t/inputs-and-configuration/28931 "2023-05-26T04:56:19Z")
Hello all! For a brief background, I walked into this (literal) job position picking up where the previous employee left off mid-setting up a graylog server. I’ve gotten it up and running, found an nxlog agent he tried… --- ## [Compounds with different value after extraction](https://community.graylog.org/t/compounds-with-different-value-after-extraction/28737)
**Author:** [@isotecviac2022](https://community.graylog.org/u/isotecviac2022)\ **Replies:** 7\ **Last updated:** [May 14, 2023, 6:39pm UTC](https://community.graylog.org/t/compounds-with-different-value-after-extraction/28737 "2023-05-14T18:39:47Z")
1. Describe your incident: Hello forum, Has anyone gone through this issue? I’m ingesting windows logs via gelf/udp with NXLog. But some fields are strange. Notice that the “Direction” and “LayerName” fields are dif… --- ## [GELF TCP and RAW TCP - NXLOG and GRAYLOG](https://community.graylog.org/t/gelf-tcp-and-raw-tcp-nxlog-and-graylog/28727)
**Author:** [@Malcolm](https://community.graylog.org/u/Malcolm)\ **Replies:** 2\ **Last updated:** [May 10, 2023, 12:01pm UTC](https://community.graylog.org/t/gelf-tcp-and-raw-tcp-nxlog-and-graylog/28727 "2023-05-10T12:01:52Z")
Hi, I’m using graylog 5.0.6 on Debian 11. I want to collect allf of the eventlog from a Windows server. I installed the nxlog community agent on it. If I configure my Input on “RAW TCP” I’m collecting a lot of informa… --- ## [Windows server logs using NXLOG showing encrypted on Graylog](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555)
**Author:** [@SodOB](https://community.graylog.org/u/SodOB)\ **Replies:** 12\ **Last updated:** [May 2, 2023, 7:03am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555 "2023-05-02T07:03:04Z")
I recently configured some Windows 2016 servers with NXLOG and Graylog, but the logs are showing encrypted, like in the screenshot attached on Graylog. OS Information: Red Hat, Inc. 1.8.0\_362 on Linux 3.10.0-1160.81.… --- ## [Process IIS Logs with GROK patterns and Extractor](https://community.graylog.org/t/process-iis-logs-with-grok-patterns-and-extractor/28156)
**Author:** [@neil0314](https://community.graylog.org/u/neil0314)\ **Replies:** 3\ **Last updated:** [March 21, 2023, 2:51am UTC](https://community.graylog.org/t/process-iis-logs-with-grok-patterns-and-extractor/28156 "2023-03-21T02:51:24Z")
I have successfully sent IIS logs to Graylog using NXlog. How can I create a pattern for the c-ip value in the message received by Graylog? Here is my NXlog configuration: \ Module xm\_csv Fields $… --- ## [Setup of Graylog and NXLog](https://community.graylog.org/t/setup-of-graylog-and-nxlog/27232)
**Author:** [@alexmercer](https://community.graylog.org/u/alexmercer)\ **Replies:** 13\ **Last updated:** [January 13, 2023, 11:23pm UTC](https://community.graylog.org/t/setup-of-graylog-and-nxlog/27232 "2023-01-13T23:23:48Z")
I have set up nxlog for windows 2016 server to send logs to graylog via udp with GELF. I can clearly see with tcpdump that I am getting messages on port 31338 udp, Graylog is set up to listen to the exact same port for … [Next page](https://community.graylog.org/tag/nxlog/18.md?match_all_tags=true&page=1&tags%5B%5D=nxlog)