USE CASE · TRANSFORMATION
Transform data at the source
Parse, normalize, filter, sample, and reshape telemetry on the agent. Cut SIEM ingest costs without losing fidelity, and feed every downstream tool the format it expects.
THE CHALLENGE
You pay for everything you don’t transform
SIEMs, observability platforms, and data lakes all charge by what you send them. Raw telemetry is noisy, inconsistently formatted, and badly shaped for the tools that have to read it.
You’re charged by what you send.
SIEMs, observability platforms, and data lakes all charge by what you send them. Raw telemetry is noisy, inconsistently formatted, and badly shaped for the tools that have to read it.
Both defaults are compromises.
Forward everything as-is and you pay to ingest noise. Transform centrally and you’ve created a single chokepoint — and you’ve still paid to move the unfiltered data to the chokepoint first.
Low-code papers over complexity.
Many tools paper over the complexity with low-code GUIs until you need real conditional logic, correlation, or a non-trivial parser — leading to brittle infrastructure that breaks with the slightest update to any component.
THE RESULT? Most pipeline tools force one of these compromises.
THE SOLUTION
Transform at the source, not just in transit
NXLog Agent processes data on the host where it’s generated, so you reduce volume, mask sensitive fields, and reshape events before they ever cross the network. Less bandwidth, lower SIEM bills, no central bottleneck.
Parse anything, output anything
JSON, CSV, XML, key-value pairs, raw text, Windows Event Log binary, ETW, NetFlow, SNMP traps, syslog variants (BSD and IETF), CEF, LEEF, GELF, W3C Extended Log File Format, Zeek, OpenTelemetry — all converted in either direction, including the messy formats that pure-JSON tools struggle with.
A real configuration language
NXLog’s configuration syntax gives you conditionals, regex, field manipulation, type casting, and custom functions. You can also extend processing with Perl, Python, or Ruby modules. Express transformations as code, version them, and deploy to single nodes or thousands just as easily.
Event correlation at the agent
Powerful correlation lets you detect patterns across multiple events (failed logons followed by success, threshold breaches, expected events that didn’t arrive) and emit a single correlated event instead of forwarding the raw stream. Stateful processing at the source.
Built-in reliability for production scale
Persistent disk queuing, flow control, prioritized processing, message buffering, and delivery guarantees ensure no events are lost or duplicated, even through network outages or restarts.
NXLog has been chosen for production deployment because of its manageability and scalability. One of the strong points of NXLog to highlight is its configuration granularity and filtration abilities that allowed us to ingest only valuable events, resulting in expenditure saving on EPS volume.
NXLog has been chosen among competitors due to its wide integration list, flexible deployment schema, and a solid reputation across the log management market.
INTEGRATIONS
Every format, in either direction
|
Syslog (RFC 3164/5424, including TLS), JSON, CSV, XML, key-value, Windows EventLog (binary and XML), ETW, NetFlow, SNMP traps, GELF, CEF, LEEF, W3C, Zeek, OpenTelemetry |
|---|---|
|
All of the above, plus vendor-specific formats for Splunk HEC, Microsoft Sentinel, Google Chronicle, Elasticsearch, and others |
|
Any SIEM, APM, data lake, or storage backend — over TCP, UDP, HTTP(S), TLS/SSL, OTLP (gRPC and HTTP), Kafka, Redis, ODBC databases, and file storage |
|
Native scripting via Perl (xm_perl), Python (xm_python), and Ruby (xm_ruby) modules |
RESOURCES
Go deeper
Documentation
Event correlation with NXLog Agent
Documentation
Available modules
Blog
Beyond basic ingestion — Advanced OpenTelemetry data processing with NXLog
GET STARTED TODAY
Cut ingest costs without losing fidelity
Start free in your own environment, or talk to us about the noisiest stream you’re paying to ingest — and what it looks like transformed at the source.
Follow us
© Copyright NXLog Ltd.