Following the documentation to receive the logs from docker, the module configuration for a Linux configuration is the following : <Input in> Module im_file File '/var/lib/docker/containers/*/*-json.log' <Exec> parse_json(); $HostID = file_basename(file_name()); $HostID =~ s/-json.log//; </Exec> </Input> However, in Windows, docker is running inside a WSL2 instance. this is why I replace the path with the docker for desktop equivalent : \\\\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\\*-json.log Now, this works only if we launch nxlog from a cmd terminal, with the -f option to run in foreground. When it is running as a Windows service, it throws an error, unable to access the files. It seems it can't resolve the \\wsl$ in the path How to access Docker WSL2 logs from Windows ?