Adding additional information into message for im_msvistalog

Post a different question
4
responses

Hello,

I'm new to nxlog and tries to integrate it with GrayLog. It's working fine but to filter data from certain Windows Event Logs into a separate stream in GrayLog I need to insert the Channel value (available in im_msvistalog) into the message text. How can this be done?

Mats-Ove

AskedMarch 19, 2018 - 12:47pm

Answer (1)

Hello,

in our documentation located here: https://nxlog.co/documentation/nxlog-user-guide#im_msvistalog_config you can see examples for im_msvistalog and also selecting channel in the Path tag.

Peter

AnsweredMarch 19, 2018 - 4:40pm

Comments (3)

  • matsovef's picture

    Hello,

    I was probably unclear.

    I have setup nxlog to select four paths that all are forwarded to GrayLog in the same output (see below). On the GrayLog side I would like to forward events from a certain path to a separate stream. My idea is to insert the value of $Channel to the beginning of the $Message and use that as a search condition on the GreyLog stream. But how do I modify the message sent from nxlog?

    <Input in>
    Module im_msvistalog
    <QueryXML>
    <QueryList>
    <Query Id='1'>
    <Select Path='Application'>*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0)]]</Select>
    <Select Path='Security'>*[System[(Level=1 or Level=2)]]</Select>
    <Select Path='System'>*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0)]]</Select>
    <Select Path='Ensym drift'>*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0)]]</Select>
    <Suppress Path='Application'>*[System[(EventID=1111 or EventID=1058)]]</Suppress>
    <Suppress Path='System'>*[System[(EventID=1111 or EventID=1058)]]</Suppress>
    </Query>
    </QueryList>
    </QueryXML>
    </Input>

    <Output out>
    Module om_udp
    Host XXX.XXX.XXX.XXX
    Port 514
    Exec to_syslog_bsd();
    </Output>

    March 20, 2018 - 9:15am
  • b0ti's picture
    (NXLog)

    This can be done via the following:

    <Exec>
  $Message = $Channel + ' ' + $Message;
  to_syslog_bsd();
</Exec>

    You should also consider using xm_gelf as that provides proper structured logging. Syslog is an outdated concept.

    March 20, 2018 - 5:46pm