I'm looking for a good configuration that sends most System, Application and Security events to an output. I would have thought this configuration would work, but it seems that I get no logs from Security at all:
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension json>
Module xm_json
</Extension>
<Input eventlog>
Module im_msvistalog
Query <QueryList>\
<Query Id="0">\
<Select Path="Security">*</Select>\
<Select Path="System">*[System/Level=4]</Select>\
<Select Path="Application">*[Application/Level=4]</Select>\
<Select Path="Setup">*[System/Level=4]</Select>\
<Select Path='Windows PowerShell'>*</Select>\
</Query>\
</QueryList>
Exec to_json();
</Input>
<Output logstash_eventlog>
Module om_tcp
Host logstash
Port 1935
</Output>
<Route 1>
Path eventlog => logstash_eventlog
</Route>
Meanwhile, nxlog.log doesn't state any obvious problems, connecting to logstash successfully. I turn on internal logging in nxlog to be sent and every single line there is successfully sent.
How do I ship Windows logs successfully with nxlog, is the question?
