> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mezmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# NXLog

> Configure NXLog on Windows to forward Windows event and file logs to an OpenTelemetry Collector, which relays them to the Mezmo OTEL Source.

NXLog is the workhorse of Windows logging plugins. Mezmo ingests NXLog data by placing an OpenTelemetry (OTel) Collector between your Windows hosts and Mezmo. NXLog forwards Syslog-formatted events to the Collector's `syslog` receiver over TLS, and the Collector relays them to Mezmo's [OpenTelemetry Source](/telemetry-pipelines/open-telemetry-source) with the `otlphttp` exporter.

```
NXLog (om_ssl output)  -->  OpenTelemetry Collector (syslog receiver)  -->  Mezmo OTEL Source (otlphttp exporter)
```

## Set Up the OpenTelemetry Collector

1. Log in to the [Mezmo Web App](https://app.mezmo.com), create (or open) a Pipeline, and add an [OpenTelemetry Source](/telemetry-pipelines/open-telemetry-source). Note the ingestion key — you'll use it as `apikey`.
2. Download the `otelcol-contrib` distribution, which includes the `syslog` receiver, from [the OpenTelemetry website](https://github.com/open-telemetry/opentelemetry-collector-releases).
3. Create a `config.yaml`:

```yaml theme={null}
receivers:
  syslog:
    protocol: rfc5424
    tcp:
      listen_address: "0.0.0.0:CUSTOM_PORT"
      tls:
        cert_file: /path/to/cert.pem
        key_file: /path/to/key.pem

exporters:
  otlphttp/mezmo:
    endpoint: "https://logs.mezmo.com/otel"
    compression: gzip
    headers:
      apikey: "<YOUR_INGESTION_KEY>"

service:
  pipelines:
    logs:
      receivers: [syslog]
      exporters: [otlphttp/mezmo]
```

4. Start the Collector:

```bash theme={null}
./otelcol-contrib --config /path/to/config.yaml
```

## Configure NXLog

Point NXLog's `om_ssl` output at the host and port where the Collector's `syslog` receiver is listening, using the same certificate you configured on the Collector.

```none theme={null}
Panic Soft
#NoFreeOnExit TRUE

define ROOT     C:\\Program Files (x86)\\nxlog
define CERTDIR  %ROOT%\\cert
define CONFDIR  %ROOT%\\conf
define LOGDIR   %ROOT%\\data
define LOGFILE  %LOGDIR%\\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\\modules
CacheDir  %ROOT%\\data
Pidfile   %ROOT%\\data\\nxlog.pid
SpoolDir  %ROOT%\\data

<Extension _syslog>
    Module      xm_syslog
</Extension>

<Extension _exec>
    Module      xm_exec
</Extension>

<Extension json>
    Module	xm_json
</Extension>

<Input internal>
    Module im_internal
    Exec $Message = to_json();
</Input>

#######################################################################
##### This is just explicit version of internal input above ###########
#######################################################################
# <Input nxlog>
#     Module im_file
#     File '%LOGFILE%'
#     <Exec>
#         $Message = $raw_event;
#         if $Message == '' drop();
#         $SourceName = substr(file_name(), size('%LOGDIR%') + 1);
#     </Exec>
# </Input>
#######################################################################

# Define Directory for Making Substring Operation
define LOGFOLDER C:\\ProgramData\\logs

<Input filelog>
    Module im_file
    File '%LOGFOLDER%\\*.log'
    Recursive TRUE
    <Exec>
        $Message = $raw_event;
        if $Message == '' drop();
        $SourceName = substr(file_name(), size('%LOGFOLDER%') + 2);
    </Exec>
</Input>

<Input eventlog>
    Module im_msvistalog
    <QueryXML>
        <QueryList>
            <Query Id='0'>
                <!--Select Path='Application'>*</Select-->
                <Select Path='System'>*</Select>
                <!--Select Path='Security'>*</Select-->
            </Query>
        </QueryList>
    </QueryXML>
    Exec $Message = to_json();
</Input>

<Processor buffer>
    Module pm_buffer
    MaxSize 102400
    Type disk
</Processor>

<Output out>
    Module om_ssl
    Host <OTEL_COLLECTOR_HOST>
    Port CUSTOM_PORT
    CAFile %CERTDIR%\ca.pem
    Exec to_syslog_ietf();
</Output>

<Route 1>
    Path internal, filelog, eventlog => buffer => out
</Route>

```

<Note>
  You can add additional logfiles by creating a new `<Input {name}>` section that imitates the previous ones, and adding the name of that section to `<Route 1>` at the end.
</Note>

## Example for Tailing Additional Log Files

```none theme={null}
<Input newlog>
    Module im_file
    File '%LOGDIR%\\example.log'
    Exec $Message = to_json();
</Input>

```