##define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

<Extension json>
    Module	xm_json
</Extension>
 
<Extension charconv>
    Module      xm_charconv
    AutodetectCharsets utf-8, cp1251
</Extension>

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

define CERTDIR %ROOT%\cert

<Input in>
    ##для Windows XP/2000/2003:
    ##Module      im_mseventlog
    ##или для Windows 2008/Vista и выше:
    Module      im_msvistalog
</Input>

<Output tcp>
    Module      om_tcp
    Host        192.168.10.161
    Port        11514
    Exec	to_json();
</Output>

<Route send>
    Path        in => tcp
</Route>

define ROOT C:\Program Files (x86)\nxlog
 
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
 
<Extension gelf>
    Module         xm_gelf
</Extension>

#<Extension fileop>
#	Module 		xm_fileop
#</Extension>
 
<Extension json>
    Module      xm_json
</Extension>
 
<Extension w3c_parser>
    Module          xm_csv
    Fields          date, time, s-ip, cs-method, cs-uri-stem, cs-uri-query, \
                    s-port, cs-username, c-ip, cs-user-Agent, cs-referer, \
                    sc-status, sc-substatus, sc-win32-status, time-taken
    FieldTypes      string, string, string, string, string, string, integer, \
                    string, string, string, string, integer, integer, integer, \
                    integer
    Delimiter       ' '
    EscapeChar      '"'
    QuoteChar       '"'
    EscapeControl   FALSE
    UndefValue      -
</Extension>

<Input iis>
    Module          im_file
    File            'C:\inetpub\logs\LogFiles\\*.log'
    <Exec>
        if $raw_event =~ /^#/ drop();
        else
        {
            w3c_parser->parse_csv();
            $EventTime = parsedate($date + "T" + $time + ".000Z");

        }
    </Exec>
</Input>
 
<Output graylog>
    Module      om_udp
    Host        graylogtest.domain.com
    Port        12201
    OutputType    GELF
	
	#debug (uncomment the fileop extension)
	#Exec file_write("C:\\Program Files (x86)\\nxlog\\data\\nxlog_output.log", $raw_event);
</Output>

<Route iis-to-graylog>
    Path        iis => graylog
</Route>