# SexiLog (ELK) doesnt receive Windows Log Files (\*.log)

**URL:** <https://discuss.elastic.co/t/sexilog-elk-doesnt-receive-windows-log-files-log/80156>\
**Category:** Logstash\
**Created:** [March 27, 2017, 3:04pm UTC](https://discuss.elastic.co/t/sexilog-elk-doesnt-receive-windows-log-files-log/80156 "2017-03-27T15:04:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![freichert](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@freichert](https://discuss.elastic.co/u/freichert)\
**Post date:** [March 27, 2017, 3:04pm UTC](https://discuss.elastic.co/t/sexilog-elk-doesnt-receive-windows-log-files-log/80156/1 "2017-03-27T15:04:38Z")

</div>

Hello everybody 🙂 since im really struggling with setting up SexiLog to receive Windows Logfiles i decided to ask you - hopefully you can show me the correct way 🙂

so. What i have so far: a functional sexilog (ELK) instance which is collecting esxi syslogs and Windows EventLogs. Now i want to monitor our Exchange Server more deep and decided to do this via the message tracking logs. Right now i am using NXLog to ship Logdata from our Exchange to Sexilog.

NXLog configuration:

```
 define ROOT C:\Program Files (x86)\nxlog

 Moduledir %ROOT%\modules  
 CacheDir %ROOT%\data  
 Pidfile %ROOT%\data\nxlog.pid  
 SpoolDir %ROOT%\data  
 LogFile %ROOT%\data\nxlog.log
 LogLevel DEBUG

 <Extension syslog>  
     Module xm_syslog
 </Extension>

 <Extension json>
     Module xm_json
 </Extension>

 <Input in_eventlog>
   Module im_msvistalog
     Query <QueryList>\
                     <Query Id="0">\
                         <Select Path="Application">*</Select>\
                         <Select Path="System">*</Select>\
                         <Select Path="Security">*</Select>\
                     </Query>\
                 </QueryList>
 </Input>

  <Input in_exchange>
     Module im_file
     File "C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs \\MessageTracking\\MSGTRK*.LOG"
     SavePos True
     Exec if $raw_event =~ /HealthMailbox/ drop();
     Exec if $raw_event =~ /^#/ drop();
 </Input>

 <Output out_eventlog>
     Module om_udp
     Host SRV-XXX-001.hc.lan
     Port 1515
 Exec to_json();
 </Output>

 <Output out_exchange>  
     Module om_udp
     Host SRV-XXX-001.hc.lan
     Port 5141
     Exec $SyslogFacilityValue = 2;
     Exec $SourceName = 'exchange_msgtrk_log';
     Exec to_syslog_bsd();
 </Output>

 <Route exchange>  
     Path in_exchange => out_exchange
 </Route>  

 <Route eventlog>
     Path in_eventlog => out_eventlog
 </Route>

```

so right now only the Eventlog is showing up in Kibana. The Logfile doesnt seem to show up in Kibana and i have no idea whats going wrong here. The NXLog Logfile doesnt contain any errors/warnings. Debug Mode shows that the Logfiles are matching the defined Wildcard., a Port Check shows that Port 5141 is listening, too.

Here is the Logstash config:

```
 input {
   udp {
     type => "Exchange"
     port => 5141
   }
 }

 filter {  
   if [type] == "Exchange" {
     csv {
             add_tag => ['exh_msg_trk']
             columns => ['logdate', 'client_ip', 'client_hostname', 'server_ip', 'server_hostname', 'source_context', 'connector_id', 'source', 'event_id', 'internal_message_id', 'message_id', 'network_message_id', 'recipient_address', 'recipient_status', 'total_bytes', 'recipient_count', 'related_recipient_address', 'reference', 'message_subject', 'sender_address', 'return_path', 'message_info', 'directionality', 'tenant_id', 'original_client_ip', 'original_server_ip', 'custom_data']
         remove_field => ["logdate"]
         }
     grok {      
          match => ["message", "%{TIMESTAMP_ISO8601:timestamp}"]
         }
     mutate {
         convert => ["total_bytes", "integer"]
         convert => ["recipient_count", "integer"]
         split => ["recipient_address", ";"]
         split => ["source_context", ";"]
         split => ["custom_data", ";"]
           }
      date {
         match => ["timestamp", "ISO8601"]
         timezone => "Europe/London"
         remove_field => ["timestamp"]
         }
     if "_grokparsefailure" in [tags] {
            drop { }
          }
      }
  }
 output {  
   elasticsearch { host => localhost }
   stdout { codec => rubydebug }
 }

```

so... if you could have a look at my configuration that'd be great. I just have no idea why the eventlogs are showing up in kibana but the logfile doesnt... I am really happy about every suggestion. If you want me to provide any logfiles just let me know.

best regards 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2017, 3:04pm UTC](https://discuss.elastic.co/t/sexilog-elk-doesnt-receive-windows-log-files-log/80156/2 "2017-04-24T15:04:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.