## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

# Include fileop when rotating logs or while debugging, also enable in the output module below
#<Extension fileop>
# Module xm_fileop
#</Extension>

# Create the parse rule for IIS logs. You can copy these from the header of the IIS log file.
<Extension w3c>
    Module xm_csv
    Fields $date, $time, $s_ip, $cs_method, $cs_uri_stem, $cs_uri_query, $s_port, $cs_username, $c_ip, $cs_User_Agent, $cs_Referer, $sc_status, $sc_substatus, $sc_win32_status, $time_taken
    FieldTypes string, string, string, string, string, string, integer, string, string, string, string, integer, integer, integer, integer
    Delimiter ' '
</Extension>

<Extension json>
 Module xm_json
</Extension>
 
<Extension syslog>
 Module xm_syslog
</Extension>
 
<Input internal>
 Module im_internal
 Exec $Message = to_json(); 
</Input>

<Input eventlog>
#This is the Windows Event Log Section - for 2008 and above use im_msvistalog - for 2003 and earlier, use im_mseventlog
#
    Module      im_msvistalog
# For windows 2003 and earlier use the following:
#   Module      im_mseventlog

Exec $raw_event = to_json();
 
</Input>

# Convert the IIS logs to JSON and use the original event time

<Input IIS_Site1>
    Module    im_file
    File    "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex*"
    SavePos  TRUE
 
    Exec if $raw_event =~ /^#/ drop();				\
       else							\
       {							\
            w3c->parse_csv();					\
            $EventTime = parsedate($date + " " + $time);	\
            $SourceName = "IIS";				\
            $raw_event = to_json();				\
       }
</Input>




<Output eventlog_out>
    Module      om_file
	file		'c:\test\eventlog.txt'
    #Rotate created files
    #<Schedule>
        #Every 1 hour
        #Exec  file_cycle('c:\test\eventlog.txt', 2);
        #Exec  eventlog_out->reopen();
    #</Schedule>
</Output>

<Output IIS_Site1_out>
    Module      om_file
	file		'c:\test\iis1.txt'
    #Rotate created files
    #<Schedule>
        #Every 1 hour
        #Exec  file_cycle('c:\test\iis1.txt', 2);
        #Exec  IIS_Site1_out->reopen();
    #</Schedule>
</Output>

<Route EventLog>
    Path        eventlog => eventlog_out
</Route>
<Route IIS_Site1>
	Path		IIS_Site1 => IIS_Site1_out
</Route>