Shipping Windows logs to Logstash via Nxlog

In order to correlate the logs of your system, you are either going to have to manually upload them to your correlation system or setup an automated way. Nxlog is one of a few agents that will enable automated shipping of logs. I particularly like it because it is light on the system and not a pain to setup. Below are the steps to get you going. I will be shipping the logs using the json format. There are many formats available, one just has to do research on which one satisfies their needs. The configuration we will use transports the logs over port 3515, so you will need to ensure that the port is open.

1. Navigate to http://nxlog.org/products/nxlog-community-edition/download and download the .msi version for Windows.

2. Install the downloaded .msi using the default options.

3. After installation is complete, open the configuration file located at C:\program files (x86)\nxlog\conf\nxlog.conf.

4. Replace the contents of the file with the below. The only thing you need to change IP address 111.111.111.111 with the IP of your Logstash server.

5. Save and close the file.

6. Open a command prompt as administrator and start the nxlog service by typing ‘net start nxlog’

7. Within a few seconds, nxlog will begin trying to connect to the Logstash server in order to begin sending logs.

8. Check your Logstash server (or Kibana) to see if it is receiving logs from the new system. If not, the nxlog log is located at C:\Program Files (x86)\nxlog\data\nxlog.txt.

9. If it is receiving, good!

10.Done!