Using NXLog with Elasticsearch and Kibana

The popularity of the ELK stack is steadily rising, many NXLog users send their event data to Elasticsearch and Kibana for log monitoring and analytics.

There are many tutorials and configurations scattered around on the web, some come with configuration samples that will likely not work properly.  For this reason we have written a short document introducing different options on how to use NXLog with Elasticsearch and Kibana, it's available under the documentation page.

Sending logs to loggly

Loggly offers cloud based storage and analytics services for log data. NXLog can be used to collect and send logs off to the Loggly service.

Below is a configuration that can be used for a start. Make sure to set the value of CUSTOMER_TOKEN properly. If you are unsure where to get this, see the article about the cusomer token in the Loggly support center.

The new release brings a WTMP parser

The new release, 2.7.1189 brings a WTMP parser module and a dozen other fixes and enhancements. The following is an excerpt from the changelog:
The LICENSE has changed.
Added a new extension module to parse binary wtmp files on Linux.
Fixed a regression causing a crash after the 'failed to determine FQDN hostname' error message.
The to_syslog_*() procedures can now use $raw_event if $Message is unset to make it easier to convert to syslog.
Added a fix to im_msvistalog to handle the "EvtNext failed with error 13: The data is invalid." error better.
The im_file module now emits the last event when using with the xm_multiline extension.