# NXLog Best Practices and Multiple Log Inputs

**URL:** <https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872>\
**Category:** Logstash\
**Created:** [September 29, 2016, 9:32pm UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872 "2016-09-29T21:32:55Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [September 29, 2016, 9:32pm UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872/1 "2016-09-29T21:32:55Z")

</div>

Has anyone seen a best practices for how to configure NXLog? Im looking for recommendations on the best way to configure CPU and memory buffers, Inputs, Outputs, Routes, ect.

Also we will have multiple Input log files besides the Windows Eventlogs that we need to pull from. Currently all of the logs are sent to port 5003 of the Logstash server and tagged as Type "WindowsEventLog". Whats the best way to break out the application logs from the Windows Event Logs? Should I just send the application logs to a different port? Is there a way of setting the Type in the NXLog config and not in the Logstash input? Is there a better way to do this?

---

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [September 29, 2016, 10:19pm UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872/2 "2016-09-29T22:19:48Z")

</div>

Also, I have a test file that I am using for configuration testing. But for some reason I dont see any information showing up within Elasticsearch. Im not sure whats going on. Here is the configuration that I am using:

```
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension json>
    Module xm_json
</Extension>

<Extension _syslog>
    Module xm_syslog
</Extension>

########## INPUTS ###########

<Input eventlog>
    Module im_msvistalog
    Exec $Message = to_json();
</Input>

<Input test_file_watch_1>
 Module im_file
 File "C:\Logtest.log"
 SavePos TRUE
</Input>

############ OUTPUTS ##############

<Processor mem_buffer>
    Module pm_buffer
    MaxSize 1024
    Type Mem
    WarnLimit 512
</Processor>

############ OUTPUTS ##############

<Output out>
    Module om_tcp
    Host 192.168.100.90
    Port 5003
</Output>

############ ROUTES TO CHOOSE #####

<Route 1>
    Path eventlog, test_file_watch_1 => mem_buffer => out
</Route>
```

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [September 30, 2016, 6:27am UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872/3 "2016-09-30T06:27:30Z")

</div>

Why would you need `mem_buffer` processor? Personally, I think nxlog already works great by default.

On nxlog, you should start by outputting to a local file first to see if events are parsed correctly. After that, output Logstash to console to see if LS receives events. If both are good, then you can check Elasticsearch.

> [@jnpetty](#):
>
> Is there a way of setting the Type in the NXLog config and not in the Logstash input?

Yes, you can add more fields to each message BEFORE converting it to JSON

```auto
$type = "wineventlog"

```

---

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [September 30, 2016, 3:43pm UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872/4 "2016-09-30T15:43:50Z")

</div>

> [@anhlqn](#):
>
> Why would you need mem\_buffer processor? Personally, I think nxlog already works great by default.

We are still new to ELK and I saw it in a example, so I thought it might help some.

Ok so I did as you suggested and outputted to a local file.

Here is the contents of the logfile that im writing to:

```
Did
this
work?
How
about
now?

```

And the output file from NXLog contained:

```
Did਍this਍work?਍How਍about਍now?਍`

```

So it would seem like I have a formatting issue. Correct?

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [October 1, 2016, 3:51am UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872/5 "2016-10-01T03:51:01Z")

</div>

Try this config to read from a file

```auto
<Input test_file_watch_1>
    Module	im_file
    File "C:\Logtest.log"
    InputType LineBased
    <Exec>
        $message = $raw_event;
        to_json();
    </Exec>
</Input>

<Output out_file>
    Module	om_file
    File	"C:\output.txt"
</Output>

<Route to_file>
    Path	test_file_watch_1 => out_file
</Route>

```

Or you can use winlogbeat and filebeat.

---

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [October 3, 2016, 4:49pm UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872/6 "2016-10-03T16:49:47Z")

</div>

Hi Anh,

So I made the suggest changes and here is the output:

```
{"EventReceivedTime":"2016-10-03 09:44:36","SourceModuleName":"test_file_watch_1","SourceModuleType":"im_file","message":"ÿþD\u0000i\u0000d\u0000"}
{"EventReceivedTime":"2016-10-03 09:44:36","SourceModuleName":"test_file_watch_1","SourceModuleType":"im_file","message":"t\u0000h\u0000i\u0000s\u0000"}
{"EventReceivedTime":"2016-10-03 09:44:36","SourceModuleName":"test_file_watch_1","SourceModuleType":"im_file","message":"w\u0000o\u0000r\u0000k\u0000?\u0000"}
{"EventReceivedTime":"2016-10-03 09:44:43","SourceModuleName":"test_file_watch_1","SourceModuleType":"im_file","message":"D\u0000i\u0000d\u0000"}
{"EventReceivedTime":"2016-10-03 09:44:43","SourceModuleName":"test_file_watch_1","SourceModuleType":"im_file","message":"t\u0000h\u0000i\u0000s\u0000"}
{"EventReceivedTime":"2016-10-03 09:44:43","SourceModuleName":"test_file_watch_1","SourceModuleType":"im_file","message":"w\u0000o\u0000r\u0000k\u0000?\u0000"}

```

Looks like its still not reading the input file correctly. Here is my input file and you can see that the Input and Output dont match

```
Did
this
work?
Did
this
work?

```

> [@anhlqn](#):
>
> Or you can use winlogbeat and filebeat.

How would going with winlogbeat and filebeat help with this situation?

---

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [October 3, 2016, 9:01pm UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872/7 "2016-10-03T21:01:45Z")

</div>

Ok I tested out beats and it still resulted in the same type of message:

`"message":"\ufffd\ufffdD\u0000o\u0000e\u0000s\u0000 \u0000t\u0000h\u0000i\u0000s\u0000 \u0000w\u0000o\u0000r\u0000k\u0000?\u0000\r\u0000"`

What am I missing?

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [October 4, 2016, 3:21am UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872/8 "2016-10-04T03:21:36Z")

</div>

I think it's just the log content that you are trying to parse. Usually you have to use a module to parse a log lines before converting them to json documents. Do you have a sample log content, a csv file for instance?

---

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [October 4, 2016, 4:48pm UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872/9 "2016-10-04T16:48:28Z")

</div>

I was able to get it working by changing the encoding to utf-16. Thanks for the help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872/10 "2017-07-06T04:35:53Z")

</div>