Created
February 20, 2015 22:59
-
-
Save ianblenke/a3ca90281705ebf55ece to your computer and use it in GitHub Desktop.
nxlog directly to elasticsearch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## This is a sample configuration file. See the nxlog reference manual about the | |
## configuration options. It should be installed locally and is also available | |
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html | |
## Please set the ROOT to the folder your nxlog was installed into, | |
## otherwise it will not start. | |
#define ROOT C:\Program Files\nxlog | |
define ROOT C:\Program Files (x86)\nxlog | |
Moduledir %ROOT%\modules | |
CacheDir %ROOT%\data | |
Pidfile %ROOT%\data\nxlog.pid | |
SpoolDir %ROOT%\data | |
LogFile %ROOT%\data\nxlog.log | |
<Extension json> | |
Module xm_json | |
</Extension> | |
# Nxlog internal logs | |
<Input internal> | |
Module im_internal | |
Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json(); | |
</Input> | |
<Input mylog> | |
Module im_file | |
File "C:\\MyApp\\Logs\\mylog.json" | |
SavePos TRUE | |
InputType LineBased | |
Exec parse_json(); | |
Exec $EventTime = parsedate($timestamp); | |
</Input> | |
<Input eventlog> | |
Module im_msvistalog | |
# For windows 2003 and earlier use the following: | |
# Module im_mseventlog | |
</Input> | |
<Output elasticsearch> | |
Module om_http | |
URL http://internal-elb-myapp-12345678.us-east-1.elb.amazonaws.com:9200 | |
ContentType application/json | |
Exec $MyAWSInstanceID = "i-1badd00d"; | |
Exec set_http_request_path(strftime($EventTime, "/logstash-%Y.%m.%d/" + $SourceModuleName)); rename_field("timestamp","@timestamp"); to_json(); | |
</Output> | |
<Route 1> | |
Path internal, eventlog, myapp => elasticsearch | |
</Route> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is it possible to add Basic authentication to send data?