A Logz.io alternative for log management | NXLog

Logz.io runs only in the public cloud — its own FAQ says so. NXLog Platform runs where your policy requires: your data center, your cloud account, or hosted by us. Air-gapped networks included.

With per-GB pricing, cost climbs at the worst possible moment — during an incident, when systems get loud. NXLog licenses by source. An endpoint under attack costs the same as an endpoint at rest.

Enroll agents, push configuration, watch health, and roll out updates from NXLog Platform. No per-host config files to hand-edit, no wondering which version runs where.

Compliance frameworks often expect a year or more of searchable log history. On NXLog Platform, on-premises storage is included and you set the retention policy — no hot-storage clock, no restore step before you can search older data.

NXLog Agent collects ETW traces, Windows Event Forwarding streams without local agents, Registry changes, file integrity events, and Microsoft DNS Server logs. A generic collector stops at the Event Log.

NXLog Agent drops, rewrites, and converts events at the source, so only data worth keeping leaves the host. If Logz.io stays in your stack, this is the fastest way to shrink its bill.

Run NXLog Platform in your data center, in your own cloud account, or let us host it. Isolated and air-gapped environments work because nothing has to phone home. Your data crosses only the network boundaries you choose.

A source is a system, device, or application NXLog collects from — a server, a firewall, a container cluster. You pay per source, and that's it: no per-GB fees, no events-per-second caps, no data volume limits. The Free plan covers up to 10 sources with the full feature set.

Windows Event Log through the modern API, Event Tracing for Windows for the channels Event Log can't reach, agentless collection from Windows Event Forwarding, Registry monitoring, file integrity monitoring, performance counters, and Microsoft DNS Server log parsing. Legacy modules cover Windows XP, 2000, and 2003 where they still run.

NXLog Platform enrolls agents, distributes configuration centrally, monitors agent health, and handles updates remotely. Solution packs give you working pipelines for common routes — Windows to Microsoft Sentinel, syslog to an OpenTelemetry backend, Okta to Google SecOps — without starting from a blank file.

Filter events, rewrite fields, and convert between formats — syslog, JSON, XML, CSV, CEF, LEEF, GELF — before data leaves the host. Buffer to disk through outages, compress and encrypt in transit, and de-duplicate repeating messages. Less noise shipped means lower storage and SIEM costs everywhere downstream.

You don't have to rip anything out on day one. Logz .io's own shipping docs keep a dedicated NXLog listener on port 8010, and NXLog Agent also speaks OTLP to OpenTelemetry endpoints. Put NXLog in front: reach the sources Logz.io's collectors can't, cut the gigabytes crossing the meter, and keep a clean exit path. Swapping the backend later is a configuration change, not a re-instrumentation project.