# How can I send my custom Windows AD server event logs to Logstash?

**URL:** https://discuss.elastic.co/t/how-can-i-send-my-custom-windows-ad-server-event-logs-to-logstash/84485
**Category:** Logstash
**Created:** [May 4, 2017, 5:55am UTC](https://discuss.elastic.co/t/how-can-i-send-my-custom-windows-ad-server-event-logs-to-logstash/84485 "2017-05-04T05:55:08Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![flyfish](https://avatars.discourse-cdn.com/v4/letter/f/ea5d25/32.png) [@flyfish](https://discuss.elastic.co/u/flyfish)
#### Post date: [May 4, 2017, 5:55am UTC](https://discuss.elastic.co/t/how-can-i-send-my-custom-windows-ad-server-event-logs-to-logstash/84485/1 "2017-05-04T05:55:08Z")

</div>

Hello,

I'd like to send my Windows server 2008 AD server logs to ELK via Nxlog, but I only see "Security" log send to KIbana, but I want "Active directory domain services,DHCP server, DNS Server, Application, Security,Setup and System logs, please check the screenshot:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/a/c/acfcd55d8b1fd6f92c24682f66f7bb3eff94e6f0.png)

Now Windows side nxlog.conf as below:

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules  
CacheDir %ROOT%\data  
Pidfile %ROOT%\data\nxlog.pid  
SpoolDir %ROOT%\data  
LogFile %ROOT%\data\nxlog.log

 Module xm\_json Module im\_internal Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to\_json(); Module im\_msvistalog

Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to\_json();

 Module om\_tcp Host 10.155.3.228 Port 3515 Exec to\_json();

\<Route 1\>  
Path internal, in=\> out

Logstash.conf

input {  
tcp {  
codec =\> json\_lines { charset =\> "UTF-8" }  
port =\> "3515"  
type =\> "windowseventlog"  
codec =\> "line"  
tags =\> ["tcpjson"]  
}  
}

filter {

if [type] == "windowseventlog" {  
json{  
source =\> "message"  
}  
if [SourceModuleName] == "eventlog" {  
mutate {  
replace =\> ["message", "%{Message}"]  
}  
mutate {  
remove\_field =\> ["Message"]  
}  
}

```
}

```

}

output {  
if [type] == "windowseventlog" {  
elasticsearch {  
hosts =\> localhost  
index =\> "windowseventlog"

}  
stdout { codec =\> rubydebug }  
}  
}

Even I changed Nxlog.conf "Input in" settings as below, but it won't work.

 Module im\_msvistalog Query \ \ \*\ \ # Exec to\_json();

Do you know why?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 1, 2017, 6:01am UTC](https://discuss.elastic.co/t/how-can-i-send-my-custom-windows-ad-server-event-logs-to-logstash/84485/2 "2017-06-01T06:01:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.