nxlog with gelf option and graylog 1.0.0 gelf input error

Tags:

#1 Andrea.Consadori

hi, i configure nxlog as describe in documentation and i configure graylog gelf input.

i open a ticket to graylog (https://github.com/Graylog2/graylog2-server/issues/984) and they say maybe is a nxlog missconfig

this is myconfig, how can i diagnose the issue from your side?

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension gelf>
Module xm_gelf
</Extension>

<Input in>
# Use 'im_mseventlog' for Windows XP, 2000 and 2003
Module im_msvistalog
# Uncomment the following to collect specific event logs only
 #Query <QueryList>\
 #<Query Id="0">\
 #<Select Path="Application">*</Select>\
 #<Select Path="System">*</Select>\
 #<Select Path="Security">*</Select>\
 #</Query>\
  #</QueryList>
</Input>

<Output out>
Module om_tcp
Host 192.168.0.95
Port 12201
OutputType GELF
</Output>

<Route r>
Path in => out
</Route>

#2 adm Nxlog ✓
#1 Andrea.Consadori
hi, i configure nxlog as describe in documentation and i configure graylog gelf input. i open a ticket to graylog (https://github.com/Graylog2/graylog2-server/issues/984) and they say maybe is a nxlog missconfig this is myconfig, how can i diagnose the issue from your side? define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Extension gelf> Module xm_gelf </Extension> <Input in> # Use 'im_mseventlog' for Windows XP, 2000 and 2003 Module im_msvistalog # Uncomment the following to collect specific event logs only  #Query <QueryList>\  #<Query Id="0">\  #<Select Path="Application">*</Select>\  #<Select Path="System">*</Select>\  #<Select Path="Security">*</Select>\  #</Query>\   #</QueryList> </Input> <Output out> Module om_tcp Host 192.168.0.95 Port 12201 OutputType GELF </Output> <Route r> Path in => out </Route>

You will need to use GELF_TCP:

<Output out>
   Module om_tcp
   Host 192.168.0.95
   Port 12201
   OutputType GELF_TCP
</Output>

GELF creates compressed payload which is only suitable with om_udp.