Hi all. I'm having some windows server that are subscribed to a nxlog server, who in turn sends the windows logs to a linux/syslog server. The syslog receives all these logs as NOTICE.USER which is not too practical. I would want the nxlog to keep the criticity of the message when forwarding them. I would want nxlog to prefix the logs with the original log sender hostname so that they appear as $PROGRAM in syslog. Also, is there a way to use some criterions to send logs from nxlog to syslog using different facilities (USER, MAIL, LOCALn,...) according to some criterions (real PROGRAM value for instance)

I would like to forward Windows Security Events into Azure's Log Analytics using NXLog instead of the Microsoft Monitoring Agent (MMA). Does anyone been able to do this? If so, would you care to share your config file setup?