title: nxlog data (gelf) to graylog2 server
body: <p>I'm using a graylog2 vm to get my firewall syslogs and it runs quite well.
  Now I'd like to get some windows logs using nxlog and that doesn't work at all.</p>
  
  <p>My guess is that my xml code in the conf file is wrong, but I've been wrong before.. Note : the VM and the windows server I want to get logs from are on the same network: </p>
  
  <pre><code>    ## This is a sample configuration file. See the nxlog reference manual about the
  ## configuration options. It should be installed locally and is also available
  ## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html
  
  ## Please set the ROOT to the folder your nxlog was installed into,
  ## otherwise it will not start.
  
  #define ROOT C:\Program Files\nxlog
  define ROOT C:\Program Files (x86)\nxlog
  
  Moduledir %ROOT%\modules
  CacheDir %ROOT%\data
  Pidfile %ROOT%\data\nxlog.pid
  SpoolDir %ROOT%\data
  LogFile %ROOT%\data\nxlog.log
  
  &lt;Extension _syslog&gt;
      Module      xm_gelf
  &lt;/Extension&gt;
  
  &lt;Input in&gt;
      Module      im_msvistalog
  # For windows 2003 and earlier use the following:
  #   Module      im_mseventlog
  
  Query &lt;QueryList&gt;\
    &lt;Query Id="0" Path="Security"&gt;\
      &lt;Select Path="Security"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="System"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-Diagnostics-Networking/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-Diagnostics-Performance/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-DiskDiagnostic/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-GroupPolicy/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-UAC/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-User Profile Service/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-WindowsUpdateClient/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="HardwareEvents"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
    &lt;/Query&gt;\
  &lt;/QueryList&gt;
  
  &lt;/Input&gt;
  
  
  &lt;EventData&gt;
    &lt;Data Name="SubjectUserSid"&gt;S-1-5-18&lt;/Data&gt; 
    &lt;Data Name="SubjectUserName"&gt;WIN-OUNNPISDHIG$&lt;/Data&gt; 
    &lt;Data Name="SubjectDomainName"&gt;WORKGROUP&lt;/Data&gt; 
    &lt;Data Name="SubjectLogonId"&gt;0x3e7&lt;/Data&gt; 
    &lt;Data Name="TargetUserSid"&gt;S-1-5-18&lt;/Data&gt; 
    &lt;Data Name="TargetUserName"&gt;SYSTEM&lt;/Data&gt; 
    &lt;Data Name="TargetDomainName"&gt;NT AUTHORITY&lt;/Data&gt; 
    &lt;Data Name="TargetLogonId"&gt;0x3e7&lt;/Data&gt; 
    &lt;Data Name="LogonType"&gt;5&lt;/Data&gt; 
    &lt;Data Name="LogonProcessName"&gt;Advapi&lt;/Data&gt; 
    &lt;Data Name="AuthenticationPackageName"&gt;Negotiate&lt;/Data&gt; 
    &lt;Data Name="WorkstationName" /&gt; 
    &lt;Data Name="LogonGuid"&gt;{00000000-0000-0000-0000-000000000000}&lt;/Data&gt; 
    &lt;Data Name="TransmittedServices"&gt;-&lt;/Data&gt; 
    &lt;Data Name="LmPackageName"&gt;-&lt;/Data&gt; 
    &lt;Data Name="KeyLength"&gt;0&lt;/Data&gt; 
    &lt;Data Name="ProcessId"&gt;0x1dc&lt;/Data&gt; 
    &lt;Data Name="ProcessName"&gt;C:\Windows\System32\services.exe&lt;/Data&gt; 
    &lt;Data Name="IpAddress"&gt;-&lt;/Data&gt; 
    &lt;Data Name="IpPort"&gt;-&lt;/Data&gt; 
  &lt;/EventData&gt;
  
  &lt;Output out-12201&gt;
      Module      om_udp
      Host        192.168.0.4
      Port        12201
      OutputType  GELF
     &lt;/Output&gt;
  
  
  &lt;Route r&gt;
      Path        in =&gt; out-12201
  &lt;/Route&gt;
  </code></pre>
  
  <p>The problem is my gelf udp input is running but nothing shows up in sources...
  Do you see anything wrong ?</p>
  
  <p>EDIT / After further investigations and help. I modified the nxlog.conf as : </p>
  
  <pre><code>## This is a sample configuration file. See the nxlog reference manual about the
  ## configuration options. It should be installed locally and is also available
  ## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html
  
  ## Please set the ROOT to the folder your nxlog was installed into,
  ## otherwise it will not start.
  
  #define ROOT C:\Program Files\nxlog
  define ROOT C:\Program Files (x86)\nxlog
  
  Moduledir %ROOT%\modules
  CacheDir %ROOT%\data
  Pidfile %ROOT%\data\nxlog.pid
  SpoolDir %ROOT%\data
  LogFile %ROOT%\data\nxlog.log
  
  &lt;Extension gelf&gt;
      Module      xm_gelf
  &lt;/Extension&gt;
  
  &lt;Input in&gt;
  Module      im_msvistalog
  # For windows 2003 and earlier use the following:
  # Module      im_mseventlog
  
  Query &lt;QueryList&gt;\
    &lt;Query Id="0" Path="Security"&gt;\
      &lt;Select Path="Security"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="System"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-Diagnostics-Networking/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-Diagnostics-Performance/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-DiskDiagnostic/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-GroupPolicy/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-UAC/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-User Profile Service/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="Microsoft-Windows-WindowsUpdateClient/Operational"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
      &lt;Select Path="HardwareEvents"&gt;*[System[(Level=1  or Level=2 or Level=3)]]&lt;/Select&gt;\
    &lt;/Query&gt;\
  &lt;/QueryList&gt;
  
  &lt;/Input&gt;
  
  
  &lt;Output out&gt;
      Module      om_udp
      Host        192.168.0.4
      Port        12201
      OutputType  GELF
     &lt;/Output&gt;
  
  
  &lt;Route r&gt;
      Path        in =&gt; out
  &lt;/Route&gt;
  </code></pre>
  
  <p>I' still not seeing anything in graylog except my supposedly running input.</p>