Looking at the nxlog.log I am getting this, so I guess nxlog is working:
2017-06-13 09:40:00 INFO nxlog-ce-2.9.1716 started
2017-06-13 10:00:02 WARNING input file was deleted: F:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking\MSGTRK2017051409-1.LOG
How can I check that logstash is receiving the logs?
I am not using Beats, so I guess that logstash is expecting Beats input. I have used multiple sources to build my ELK stack I guess that this is why I can't see any data.
Is there some documentation on how to create logstash.json to get input from nxLog?
To check if Logstash is processing some events you can use stats API. For example visit (or curl) this endpoint localhost:9600/_stats?pretty=true
To manually check what is the output of your config, you can let Logstash write events to console using this output:
output {
stdout { codec => rubydebug }
}
At first you will need to setup input according to how is Exchange configured. Do you want to read lines from file ? On same computer where logstash resides or different one ? Or do you need to listen on tcp/udp port instead?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.