A Fluentd alternative built for security teams
Security telemetry, minus the Ruby overhead.
Collect Windows Event Log, ETW, syslog, files, and endpoint telemetry with one compiled C agent — managed from a single console and delivered to any SIEM.
Fortune 500 companies trust NXLog
Fluentd vs. NXLog Platform at a glance
Replace Fluentd where it matters most — your security telemetry
Why teams choose NXLog Platform
Windows telemetry at security depth
Fluentd reads the Windows Event Log through a plugin and doesn't reach ETW. NXLog Agent collects through the native API (im_msvistalog), captures ETW providers (im_etw), and receives forwarded events agentlessly (im_wseventing).
One compiled agent, no runtime to babysit
No Ruby interpreter, no gem conflicts, no plugin compatibility checks before every upgrade. One package and one configuration language across 40+ platform and architecture combinations.
Manage the fleet, not the config files
Fluentd ships no fleet management layer. NXLog Platform enrolls, configures, monitors, and updates agents from one console — up to 100,000 per node, with role-based access control and audit logs.
Evidence-grade collection, processed at the source
File integrity monitoring, registry monitoring, Linux audit, macOS logging, DNS telemetry, and packet capture — one agent. Filter and trim at the endpoint, so your SIEM bill reflects signal, not raw volume.
Keep your SIEM — and even your Fluentd
Route to Splunk, Microsoft Sentinel, Google SecOps, Elasticsearch, IBM QRadar, Kafka, Amazon S3, and more. Or keep your Fluentd aggregation tier and put NXLog Agent in front of it while you migrate.
Need help? Book a short migration workshop
Value by Team
Detection engineer / SOC analyst
Fewer blind spots. Windows, endpoint, and network telemetry arrive parsed and normalized, so rules fire on structured fields — not regex luck.
Security engineer (pipeline owner)
One agent for syslog, files, Windows, databases, and cloud sources. Filter and trim at the source to cut SIEM ingestion costs.
Incident responder / threat hunter
ETW, DNS, and file integrity signals are already flowing when you need them, and buffered delivery preserves evidence through network outages.
CISO / platform owner
Role-based access control, audit trails, vendor accountability, and per-source pricing — instead of unbudgeted engineering hours spent maintaining community plugins.
What you get with NXLog Platform
One agent, every OS
One cross-platform agent for Windows, Linux, macOS, BSD, AIX, and Solaris on x64, x86, ARM, PowerPC, and SPARC — 40+ combinations, including legacy Windows systems no other agent supports.
A pipeline language built for log work
Parse JSON, CSV, XML, key-value pairs, and syslog. Enrich, filter, rewrite, and correlate with conditionals, pattern matching, and regex — and extend with Python, Perl, Go, or Java when you need custom logic.
Built-in storage and analytics
High-compression retention, fast search, and dashboards out of the box. Use it alongside your SIEM or on its own.
Security and compliance
TLS/SSL in transit, role-based access control, tamper-proof audit logs, file integrity monitoring, and PII protection.
OpenTelemetry, natively
Ingest, transform, and output OpenTelemetry data alongside logs and metrics — one agent for security and observability telemetry.
Try NXLog Platform for free
FAQs
Configurations aren't compatible, but the concepts map directly: an in_tail source with a JSON parser and a match block becomes an im_file input with parse_json() and a route. You can run both side by side, compare completeness in your backend, and cut over source by source.
The license is free; operating Fluentd isn't. Its plugin registry is large and decentralized, and Fluentd's own documentation warns that "any fluentd plugin can unknowingly break fluentd completely" — so plugin vetting, gem upkeep, and fleet tooling land on your team. NXLog Platform pricing is per source, not per gigabyte, and it's free for up to 10 sources.
Yes. NXLog is vendor-agnostic, with native outputs for Splunk, Microsoft Sentinel, Google SecOps, Elasticsearch, IBM QRadar, Apache Kafka, Amazon S3, Graylog, Prometheus, and more.
Yes. A common pattern keeps Fluentd as the aggregation tier while NXLog Agent collects and normalizes Windows and security telemetry in front of it — useful during migration or as a permanent split.
NXLog Agent buffers to disk, defers forwarding, and fails over between destinations until delivery succeeds — so an outage doesn't cost you evidence.
Fluentd® is a registered trademark of The Linux Foundation in the United States and/or other countries. Product information is based on publicly available documentation as of July 2026.
Follow us
© Copyright NXLog Ltd.