nxlog.conf

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally under
## /usr/share/doc/nxlog-ce/ and is also available online at
## http://nxlog.org/docs

########################################
# Global directives                    #
########################################
User nxlog
Group nxlog

LogFile /var/log/nxlog/nxlog.log
LogLevel INFO

########################################
# Modules                              #
########################################
<Extension _syslog>
    Module      xm_syslog
</Extension>

<Extension _charconv>
    Module      xm_charconv
    AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
</Extension>

<Extension _json>
   Module xm_json
</Extension>

<Extension _exec>
    Module      xm_exec
</Extension>

########################################
# Routes                               #
########################################
<Input suricata>
    Module      im_file
    File        "/nsm/sensor_data/ELKHunter-eth1/eve.json"
    Exec        $message = $raw_event;
    Exec        $type = "suricata";
</Input>

<Output suricata_out>
    Module      om_tcp
    Host        127.0.0.1
    Port        6051
    Exec        to_json();
</Output>

<Route suricata_route>
    Path        suricata => suricata_out
</Route>

<Input bro_conn>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/conn.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_conn";
    ReadFromLast TRUE
</Input>
<Input bro_dhcp>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/dhcp.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_dhcp";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_dns>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/dns.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_dns";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_dpd>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/dpd.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_dpd";
    #ReadFromLast FALSE
    ReadFromLast TRUE
</Input>
<Input bro_files>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/files.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_files";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_ftp>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/ftp.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_ftp";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_http>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/http*.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_http";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_irc>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/irc.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_irc";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_kerberos>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/kerberos.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_kerberos";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_mysql>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/mysql.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_mysql";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_notice>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/notice.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_notice";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_rdp>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/rdp.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_rdp";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_signatures>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/signatures.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_signatures";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_smtp>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/smtp.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_smtp";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_snmp>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/snmp.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_snmp";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
#<Input bro_socks>
#    Module     im_file
    #InputType  w3cinput
#    File       "/nsm/bro/logs/current/socks.log"
#    Exec       $message = $raw_event;
#    Exec       $type = "bro_socks";
    #ReadFromLast FALSE
#</Input>
<Input bro_software>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/software.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_software";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_ssh>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/ssh.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_ssh";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_ssl>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/ssl.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_ssl";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_tunnel>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/tunnel.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_tunnel";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_weird>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/weird.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_weird";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>
<Input bro_x509>
    Module      im_file
    #InputType  w3cinput
    File        "/nsm/bro/logs/current/x509.log"
    Exec        $message = $raw_event;
    Exec        $type = "bro_x509";
    ReadFromLast TRUE
    #ReadFromLast FALSE
</Input>

<Processor buffer>
    Module      pm_buffer
    # 1Mb buffer
    MaxSize     102400
    Type        Mem
    # warn at 512k
    WarnLimit   51200
</Processor>

<Output bro_out>
    Module      om_tcp
    Host        127.0.0.1
    Port        6050
    Exec        to_json();
</Output>

<Route bro_route>
    Path        bro_conn,bro_dhcp,bro_dns,bro_dpd,bro_files,bro_ftp,bro_http,bro_irc,bro_kerberos,bro_mysql,bro_notice,bro_rdp,bro_signatures,bro_smtp,bro_snmp,bro_software,bro_ssh,bro_ssl,bro_tunnel,bro_weird,bro_x509 => buffer => bro_out
</Route>