title: Using nxlog to ship logs in to logstash from Windows using om_ssl
body: <p>I have been looking at options to ship logs from Windows, I have already got logstash set up, and I currently ship logs from Linux (CentOS) servers to my ELK stack using the logstash-forwarder and ssl encryption.</p>
  
  <p>For compliance reasons encryption is pretty much essential in this environment.</p>
  
  <p>I was hoping to use logstash-forwarder in Windows as well, but after compiling with Go I ran in to issues shipping Event Logs, and I found some people saying that it wasn't possible because of file locking issues, which the logstash-forwarder people appear to be working on, but I can't really wait.</p>
  
  <p>Anyway, eventually I found out that nxlog seems to be able to ship logs in an encrypted format using ssl, I've found a <a href="https://stackoverflow.com/questions/25294127/using-ssl-to-ship-from-nxlog-to-logstash">few</a> <a href="http://www.ragingcomputer.com/2014/02/logstash-elasticsearch-kibana-for-windows-event-logs" rel="nofollow noreferrer">posts</a> <a href="http://www.ragingcomputer.com/2014/02/logstash-elasticsearch-kibana-for-windows-event-logs" rel="nofollow noreferrer">about</a> <a href="http://everythingshouldbevirtual.com/highly-available-elk-elasticsearch-logstash-kibana-setup" rel="nofollow noreferrer">similar</a> <a href="http://sysxfit.com/blog/2013/07/18/logging-with-logstash-part-3/" rel="nofollow noreferrer">topics</a> and while I've learned quite a bit about how to ship the logs across and how to set up nxlog, I am still at a loss with how to set up logstash to accept the logs so I can process them.</p>
  
  <p>I've asked in the #nxlog and #logstash irc channels, and got some confirmation in #nxlog that it is possible, no further information on how it should be configured.</p>
  
  <p>Anyway, I have taken the crt file created for use with my logstash-forwarder (I will create a new one if needed when I am happy that this will work) and renamed it with a pem extension, which I believe should work as it is readable in ASCII format. I have created the environment variable for %CERTDIR% and put my file in there, I have written the following config file for nxlog from the other articles I have read, I think it is right, but I am not 100% sure:</p>
  
  <pre><code>## This is a sample configuration file. See the nxlog reference manual about the
  ## configuration options. It should be installed locally and is also available
  ## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html
  
  ## Please set the ROOT to the folder your nxlog was installed into,
  ## otherwise it will not start.
  
  #define ROOT C:\Program Files\nxlog
  define ROOT C:\Program Files (x86)\nxlog
  
  Moduledir %ROOT%\modules
  CacheDir %ROOT%\data
  Pidfile %ROOT%\data\nxlog.pid
  SpoolDir %ROOT%\data
  LogFile %ROOT%\data\nxlog.log
  
  # Enable json extension
  &lt;Extension json&gt;
      Module xm_json
  &lt;/Extension&gt;
  
  # Nxlog internal logs
  &lt;Input internal&gt;
      Module im_internal
      Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
  &lt;/Input&gt;
  
  # Windows Event Log
  &lt;Input eventlog&gt;
    # Uncomment im_msvistalog for Windows Vista/2008 and later
      Module im_msvistalog
    # Uncomment im_mseventlog for Windows XP/2000/2003
    # Module im_mseventlog
      Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
  &lt;/Input&gt;
  
  &lt;Output sslout&gt;
      Module          om_ssl
      Host            lumberjack.domain.com
      Port            5000
      CertFile        %CERTDIR%/logstash-forwarder.crt
      AllowUntrusted  TRUE
      OutputType      Binary
  &lt;/Output&gt;
  
  &lt;Route 1&gt;
      Path     eventlog, internal =&gt; sslout
  &lt;/Route&gt;
  </code></pre>
  
  <p><strong>What I want to know is what input format to use in logstash</strong> I have tried shipping logs in to a lumberjack input type (using the same config as my logstash-forwarders use) with the following config:</p>
  
  <pre><code>input {
    lumberjack {
      port =&gt; 5000
      type =&gt; "logs"
      ssl_certificate =&gt; "/etc/pki/tls/certs/logstash-forwarder.crt"
      ssl_key =&gt; "/etc/pki/tls/private/logstash-forwarder.key"
    }
  }
  </code></pre>
  
  <p>But when the service started I get the following in the nxlog logfiles:</p>
  
  <pre><code>2014-11-06 21:16:20 INFO connecting to lumberjack.domain.com:5000
  2014-11-06 21:16:20 INFO nxlog-ce-2.8.1248 started
  2014-11-06 21:16:21 INFO successfully connected to lumberjack.domain.com:5000
  2014-11-06 21:16:22 INFO remote closed SSL socket
  2014-11-06 21:16:22 INFO reconnecting in 1 seconds
  2014-11-06 21:16:23 INFO connecting to lumberjack.domain.com:5000
  2014-11-06 21:16:24 INFO reconnecting in 2 seconds
  2014-11-06 21:16:24 ERROR couldn't connect to ssl socket on lumberjack.antmarketing.com:5000; No connection could be made because the target machine actively refused it.
  </code></pre>
  
  <p>When I turned the logging up to DEBUG I see a massive amount of logs flying through, but I think the key part is:</p>
  
  <pre><code>2014-11-06 21:20:18 ERROR Exception was caused by "rv" at om_ssl.c:532/io_err_handler(); [om_ssl.c:532/io_err_handler()] -; [om_ssl.c:501/om_ssl_connect()] couldn't connect to ssl socket on lumberjack.domain.com:5000; No connection could be made because the target machine actively refused it.
  </code></pre>
  
  <p>I assume this points to me using the wrong input method on logstash, but I guess it could also be an issue with my ssl certs or the way it is configured. I don't appear to be getting any logs on the logstash server being generated at the time I make the connection from my Windows machine.</p>