I'm new to nxlog and tries to integrate it with GrayLog. It's working fine but to filter data from certain Windows Event Logs into a separate stream in GrayLog I need to insert the Channel value (available in im_msvistalog) into the message text. How can this be done?


AskedMarch 19, 2018 - 12:47pm

Answer (1)


in our documentation located here: https://nxlog.co/documentation/nxlog-user-guide#im_msvistalog_config you can see examples for im_msvistalog and also selecting channel in the Path tag.


Comments (3)

  • matsovef's picture


    I was probably unclear.

    I have setup nxlog to select four paths that all are forwarded to GrayLog in the same output (see below). On the GrayLog side I would like to forward events from a certain path to a separate stream. My idea is to insert the value of $Channel to the beginning of the $Message and use that as a search condition on the GreyLog stream. But how do I modify the message sent from nxlog?

    <Input in>
    Module im_msvistalog
    <Query Id='1'>
    <Select Path='Application'>*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0)]]</Select>
    <Select Path='Security'>*[System[(Level=1 or Level=2)]]</Select>
    <Select Path='System'>*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0)]]</Select>
    <Select Path='Ensym drift'>*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0)]]</Select>
    <Suppress Path='Application'>*[System[(EventID=1111 or EventID=1058)]]</Suppress>
    <Suppress Path='System'>*[System[(EventID=1111 or EventID=1058)]]</Suppress>

    <Output out>
    Module om_udp
    Port 514
    Exec to_syslog_bsd();

  • b0ti's picture

    This can be done via the following:

      $Message = $Channel + ' ' + $Message;

    You should also consider using xm_gelf as that provides proper structured logging. Syslog is an outdated concept.