nxlog.conf

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/docs/
## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

# define ROOT C:\Program Files\nxlog 
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

# Extension Module 
<Extension json>
    Module      xm_json
</Extension>
<Input winlog>
    Module      im_msvistalog
# Uncomment if you want only specific logs
    Query       <QueryList>\
                    <Query Id="0">\
                        <Select Path="Application">*[System/Level &lt;=3]</Select>\
                        <Select Path="System">*[System/Level &lt;=3]</Select>\
						<Select Path="Security">*</Select>\
                        <Suppress Path="Security">*[System[(EventID=5152 or EventID=5157 or EventID=4957)]]</Suppress>\
                    </Query>\
                </QueryList>	
</Input>
<Input nginx>
    Module      im_file
	file        "E:\\Software\\nginx-1.10.1\\logs\\error.log"
</Input>

<Input tomcat>
    Module      im_file
    file        "E:\\Software\\apache-tomcat-8.0.36\\logs\\error.log"
</Input>

<Output logstash>
    Module      om_tcp
    Host        localhost
    Port        5549
    Exec        to_json();
</Output>

<Route 66>
    Path        winlog, nginx, tomcat => logstash
</Route>