GrayLog 사용하기 - NXLog Setup (2)

IIS 웹 로그와 이벤트 로그를 한꺼번에 GrayLog 로 보내는 NXLog 설정을 알아보자.
아래 설정 시 주의할 점은 IIS 웹 로그의 포멧을 맞추는 것이다.

---- nxlog.conf

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension gelf>
    Module         xm_gelf
</Extension>

<Extension fileop>
    Module         xm_fileop
</Extension>

 <Extension json>
    Module      xm_json
</Extension>

# Create the parse rule for IIS logs. You can copy these from the header of the IIS log file.
<Extension w3c>
    Module             xm_csv
    Fields             $date, $time, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $cs-Referer, $sc-status, $sc-substatus, $sc-win32-status, $time-taken
    FieldTypes         string, string, string, string, string, string, integer, string, string, string, string, integer, integer, integer, integer
    Delimiter         ' '
    QuoteChar         '"'
    EscapeControl     FALSE
    UndefValue         -
</Extension>

<Input iis>
    Module        im_file
    File        "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex*"
    SavePos      TRUE

    Exec        if $raw_event =~ /^#/ drop();                    \
                else                                             \
                {                                                \
                    w3c->parse_csv();                            \
                    $EventTime = parsedate($date + " " + $time); \
                    $EventTime = strftime($EventTime, "%Y-%m-%dT%H:%M:%SZ"); \
                    $SourceName = "IIS";                         \
                    $Message = to_json();                         \
                }
</Input>

<Input eventlog>
    Module      im_msvistalog
</Input>

<Output graylog>
    Module      om_udp
    Host        log.wign21.net
    Port        5415
    OutputType    GELF

    #Use the following line for debugging (uncomment the fileop extension above as well)
    Exec file_write("C:\\Program Files (x86)\\nxlog\\data\\nxlog_output.log", $raw_event);
</Output>

<Route eventlog>
    Path        eventlog => graylog
</Route>

<Route iis-to-graylog>
    Path        iis => graylog
</Route>