Nxlog not handling winevent TimeCreated | Log collection solutions

#1 cybergoof 8 years ago

I'm using NXlog to ship windows event logs to an ELK stack. I need to preserve the datetime when the event happened <TimeCreated SystemTime=> that is stored in the event log.

However, the NXLog that is shipped doesn't preserve <TimeCreated SystemTime>, which I assume is because its invalid json. How can I preserve this in my nxlog.conf? Otherwise, I'm stuck with EventTime, which appears to be the datetime of when nxlog processes the event, not when the event happened.

How do I handle this?

Permalink

#2 adm Nxlog ✓ 8 years ago

#1 cybergoof

I'm using NXlog to ship windows event logs to an ELK stack. I need to preserve the datetime when the event happened <TimeCreated SystemTime=> that is stored in the event log. However, the NXLog that is shipped doesn't preserve <TimeCreated SystemTime>, which I assume is because its invalid json. How can I preserve this in my nxlog.conf? Otherwise, I'm stuck with EventTime, which appears to be the datetime of when nxlog processes the event, not when the event happened. How do I handle this?

The value of TimeCreated is stored in EventTime.