# NXLog Platform Documentation

> NXLog Platform is a centralized telemetry data management solution for
> collecting, processing, storing, and analyzing logs, metrics, and traces at
> enterprise scale. NXLog Agent - the collection engine - runs on Windows,
> Linux, and macOS and natively supports OpenTelemetry (OTLP), collecting and
> forwarding logs, metrics, and traces to any destination. Agents are managed
> centrally through the NXLog Platform web UI or REST API. This documentation
> covers installation, configuration, agent management, telemetry data
> collection, storage, analytics, and integrations with third-party systems
> and SIEMs.

## Getting Started

- [Platform overview](https://docs.nxlog.co/platform/current/platform-overview.html): Architecture, key concepts, and how NXLog Platform components fit together
- [Quick start guide](https://docs.nxlog.co/platform/current/quick-start-guide.html): End-to-end walkthrough from installation to first telemetry data collection pipeline
- [Install on Linux](https://docs.nxlog.co/platform/current/install-platform-on-linux.html): System requirements and step-by-step on-premises installation for Linux
- [Install on Kubernetes](https://docs.nxlog.co/platform/current/install-platform-using-helm.html): Helm-based Kubernetes deployment
- [Terminology](https://docs.nxlog.co/platform/current/terminology.html): Definitions of NXLog Platform terms and concepts
- [OpenTelemetry (OTel/OTLP) support](https://docs.nxlog.co/platform/current/glossary/opentelemetry.html): NXLog Agent's native OpenTelemetry support — includes OpenTelemetry Collector and Exporter modules for collecting and forwarding logs, metrics, and traces over OTLP

## Platform Administration

- [Administration overview](https://docs.nxlog.co/platform/current/administration/): Managing users, roles, SSO, backups, and platform settings
- [NXLog Platform architecture](https://docs.nxlog.co/platform/current/administration/explanation/nxlog-platform-architecture.html): How platform components interact — data flow, services, and ports
- [Users and roles](https://docs.nxlog.co/platform/current/administration/explanation/users-and-roles.html): Role-based access control model and permission levels
- [Single sign-on (SSO)](https://docs.nxlog.co/platform/current/administration/how-to/activate-single-sign-on.html): Configuring SSO with Google, Microsoft, or GitLab
- [Back up and restore](https://docs.nxlog.co/platform/current/administration/how-to/back-up-and-restore.html): Backup procedures and restoration steps for on-premises deployments
- [CLI reference](https://docs.nxlog.co/platform/current/administration/reference/cli-commands.html): Administrative command-line interface reference
- [Roles and permissions reference](https://docs.nxlog.co/platform/current/administration/reference/roles-and-permissions.html): Full matrix of roles and what each can access or modify

## Agent Management

- [Agent management overview](https://docs.nxlog.co/platform/current/agent-management/): Enrolling, configuring, and monitoring NXLog Agents from the platform
- [Enroll an agent](https://docs.nxlog.co/platform/current/agent-management/how-to/enroll-an-agent.html): Register a new NXLog Agent with the platform (manual and auto-enrollment)
- [Auto-enrollment](https://docs.nxlog.co/platform/current/agent-management/explanation/auto-enroll.html): Rule-based automatic agent enrollment at scale
- [Create a configuration](https://docs.nxlog.co/platform/current/agent-management/how-to/create-a-configuration.html): Build and deploy agent configurations from the platform UI
- [Configuration builder](https://docs.nxlog.co/platform/current/agent-management/explanation/configuration-builder.html): Visual drag-and-drop tool for assembling agent pipeline configurations
- [Agent connectivity](https://docs.nxlog.co/platform/current/agent-management/explanation/agent-connectivity.html): How agents communicate with the platform, including supported protocols
- [Bulk deploy with Ansible](https://docs.nxlog.co/platform/current/agent-management/how-to/deploy-nxlog-with-ansible.html): Mass deployment of NXLog Agent using Ansible
- [Bulk deploy with GPO](https://docs.nxlog.co/platform/current/agent-management/how-to/deploy-nxlog-with-microsoft-gpo.html): Mass deployment using Windows Group Policy Objects
- [Bulk deploy with Puppet](https://docs.nxlog.co/platform/current/agent-management/how-to/deploy-nxlog-with-puppet-bolt.html): Mass deployment using Puppet Bolt
- [Certificates](https://docs.nxlog.co/platform/current/agent-management/explanation/certificates.html): TLS certificate management for agent-platform communication

## Log Collection

- [Log collection overview](https://docs.nxlog.co/platform/current/log-collection/): NXLog Agent capabilities for collecting, processing, and forwarding logs, metrics, and traces
- [Data collection modes](https://docs.nxlog.co/platform/current/log-collection/explanation/data-collection-modes.html): Agent-based, agentless, active, and passive collection approaches for logs and metrics
- [Records and fields](https://docs.nxlog.co/platform/current/log-collection/explanation/records-and-fields.html): NXLog data model including OpenTelemetry-compatible log, metric, and trace record types
- [Modules and routes](https://docs.nxlog.co/platform/current/log-collection/explanation/modules-and-routes.html): Input, processor, and output modules; route-based pipeline architecture
- [Create your first configuration (tutorial)](https://docs.nxlog.co/platform/current/log-collection/tutorials/create-your-first-configuration.html): Step-by-step tutorial for building a telemetry data collection pipeline
- [Parse unstructured events](https://docs.nxlog.co/platform/current/log-collection/how-to/parse-unstructured-events.html): Extracting structured fields from plain-text log data
- [Parse common event formats](https://docs.nxlog.co/platform/current/log-collection/how-to/parse-common-event-formats.html): Syslog, CEF, W3C Extended Log Format, and other standard formats
- [Convert data formats](https://docs.nxlog.co/platform/current/log-collection/how-to/convert-data-formats.html): Converting between JSON, CSV, XML, Syslog, and other formats
- [Collect host metrics](https://docs.nxlog.co/platform/current/log-collection/how-to/collect-host-metrics.html): Collecting CPU, memory, disk, and network metrics from hosts
- [Convert events to metrics](https://docs.nxlog.co/platform/current/log-collection/how-to/convert-events-to-metrics.html): Deriving metrics from log events
- [Forward events to common destinations](https://docs.nxlog.co/platform/current/log-collection/how-to/forward-events-to-common-destinations.html): Sending telemetry data to SIEMs, databases, cloud storage, and other targets
- [Expose Prometheus-compatible metrics](https://docs.nxlog.co/platform/current/log-collection/how-to/expose-prometheus-compatible-metrics.html): Serving metrics in Prometheus format for scraping
- [Configure TLS/SSL](https://docs.nxlog.co/platform/current/log-collection/how-to/configure-tls-ssl.html): Encrypting telemetry data in transit between agent and destination
- [Buffering and flow control](https://docs.nxlog.co/platform/current/log-collection/explanation/buffering-and-flow-control.html): Preventing telemetry data loss when destinations are temporarily unavailable
- [High availability](https://docs.nxlog.co/platform/current/log-collection/explanation/high-availability.html): Fault-tolerant and load-balanced collection architectures
- [Mask sensitive data](https://docs.nxlog.co/platform/current/log-collection/how-to/mask-data.html): Redacting or anonymizing fields before forwarding

## Log Storage

- [Log storage overview](https://docs.nxlog.co/platform/current/log-storage/): Managing log types, retention, access control, and data purging
- [Log types management](https://docs.nxlog.co/platform/current/log-storage/explanation/log-types-management.html): How NXLog Platform organizes and stores incoming telemetry data
- [Set data retention](https://docs.nxlog.co/platform/current/log-storage/how-to/set-data-retention.html): Configuring how long telemetry data is stored before automatic deletion
- [Access rules](https://docs.nxlog.co/platform/current/log-storage/explanation/access-rules.html): Controlling which users and roles can query which telemetry data

## Log Analytics

- [Log analytics overview](https://docs.nxlog.co/platform/current/log-analytics/): Searching, querying, and visualizing telemetry data in NXLog Platform
- [Search logs](https://docs.nxlog.co/platform/current/log-analytics/how-to/search-logs.html): Full-text and structured search across collected telemetry data
- [Log discovery](https://docs.nxlog.co/platform/current/log-analytics/explanation/log-discovery.html): Automatically discovering and categorizing incoming telemetry data types
- [Create a dashboard](https://docs.nxlog.co/platform/current/log-analytics/how-to/create-a-dashboard.html): Building visualization dashboards from telemetry data

## NXLog Agent Reference

- [NXLog Agent documentation](https://docs.nxlog.co/agent/current/index.html): Full reference manual for NXLog Agent — the telemetry data collection and processing engine for logs, metrics, and traces
- [Install on Windows](https://docs.nxlog.co/agent/current/install/windows.html): Installing NXLog Agent on Windows and connecting to NXLog Platform
- [Install on Linux (RHEL/CentOS)](https://docs.nxlog.co/agent/current/install/rhel.html): Installing NXLog Agent on Red Hat Enterprise Linux and connecting to NXLog Platform
- [Install on Debian/Ubuntu](https://docs.nxlog.co/agent/current/install/debian.html): Installing NXLog Agent on Debian and Ubuntu and connecting to NXLog Platform
- [Install on macOS](https://docs.nxlog.co/agent/current/install/macos.html): Installing NXLog Agent on macOS and connecting to NXLog Platform
- [Global configuration settings](https://docs.nxlog.co/agent/current/config/global-settings.html): Top-level agent settings (log level, cache, paths, user/group)
- [Common module settings](https://docs.nxlog.co/agent/current/config/common-settings.html): Settings shared by all input, output, and processor modules (buffering, flow control, scheduling)
- [NXLog language reference](https://docs.nxlog.co/agent/current/language/index.html): NXLog's built-in scripting language for processing telemetry data — types, operators, expressions, statements
- [Core functions](https://docs.nxlog.co/agent/current/language/core-functions.html): Built-in functions for string handling, date parsing, field access, and more
- [Core procedures](https://docs.nxlog.co/agent/current/language/core-procedures.html): Built-in procedures for dropping, routing, hashing, and logging events
- [Input modules](https://docs.nxlog.co/agent/current/im/index.html): All supported data sources — files, Windows Event Log, syslog, TCP/SSL, Kafka, HTTP, OTel, cloud APIs, and more
- [OpenTelemetry Collector module (im_otel)](https://docs.nxlog.co/agent/current/im/otel.html): Receiving logs, metrics, and traces over OTLP
- [Windows Event Log module (im_msvistalog)](https://docs.nxlog.co/agent/current/im/msvistalog.html): Collecting Windows Event Log data
- [File input module (im_file)](https://docs.nxlog.co/agent/current/im/file.html): Reading from log files with rotation, position tracking, and wildcard support
- [Internal metrics module (im_internalmetrics)](https://docs.nxlog.co/agent/current/im/internalmetrics.html): Collecting NXLog Agent performance and health metrics
- [TCP/SSL input module (im_ssl)](https://docs.nxlog.co/agent/current/im/ssl.html): Receiving encrypted telemetry data over TLS
- [Kafka input module (im_kafka)](https://docs.nxlog.co/agent/current/im/kafka.html): Consuming messages from Apache Kafka
- [Output modules](https://docs.nxlog.co/agent/current/om/index.html): All supported destinations — files, TCP/SSL, HTTP, Kafka, Elasticsearch, OTel, cloud storage, and more
- [OpenTelemetry Exporter module (om_otel)](https://docs.nxlog.co/agent/current/om/otel.html): Forwarding logs, metrics, and traces over OTLP
- [HTTP output module (om_http)](https://docs.nxlog.co/agent/current/om/http.html): Sending telemetry data to HTTP/HTTPS endpoints
- [Prometheus output module (om_prometheus)](https://docs.nxlog.co/agent/current/om/prometheus.html): Exposing metrics in Prometheus format
- [Elasticsearch output module (om_elasticsearch)](https://docs.nxlog.co/agent/current/om/elasticsearch.html): Writing directly to Elasticsearch
- [Extension modules](https://docs.nxlog.co/agent/current/xm/index.html): Parsers and formatters for JSON, CSV, XML, Syslog, CEF, LEEF, Grok, and other formats
- [JSON extension (xm_json)](https://docs.nxlog.co/agent/current/xm/json.html): Parsing and generating JSON
- [Syslog extension (xm_syslog)](https://docs.nxlog.co/agent/current/xm/syslog.html): Parsing and generating BSD and IETF syslog
- [Grok extension (xm_grok)](https://docs.nxlog.co/agent/current/xm/grok.html): Parsing unstructured text using Grok patterns
- [CEF extension (xm_cef)](https://docs.nxlog.co/agent/current/xm/cef.html): Parsing and generating ArcSight Common Event Format
- [Processor modules](https://docs.nxlog.co/agent/current/pm/index.html): Pipeline processors — buffering, null routing, event correlation, deduplication
- [Buffer processor (pm_buffer)](https://docs.nxlog.co/agent/current/pm/buffer.html): Disk-backed event buffering to protect against telemetry data loss
- [Event correlation (pm_evcorr)](https://docs.nxlog.co/agent/current/pm/evcorr.html): Correlating events across time windows with threshold and pair rules
- [Troubleshooting NXLog Agent](https://docs.nxlog.co/agent/current/troubleshoot/nxlog-agent-logs.html): Reading and interpreting NXLog Agent diagnostic logs

## Integration Guides

- [Integration guides overview](https://docs.nxlog.co/integrations/): Collecting telemetry data from specific products, operating systems, protocols, and platforms
- [SIEM integrations](https://docs.nxlog.co/integrations/siem/): Splunk, Microsoft Sentinel, IBM QRadar, Elastic, Google SecOps, Graylog, and more
- [Operating systems](https://docs.nxlog.co/integrations/os/): Windows Event Log, Linux Audit, macOS, Sysmon, and more
- [Network devices](https://docs.nxlog.co/integrations/network/): Cisco, F5, Check Point, Microsoft Active Directory, and more
- [Virtualization and containers](https://docs.nxlog.co/integrations/virtualization/): Docker, Kubernetes, VMware, and cloud metadata
- [Databases](https://docs.nxlog.co/integrations/db/): Elasticsearch, Microsoft SQL Server, MongoDB, Oracle, and more
- [ICS/SCADA systems](https://docs.nxlog.co/integrations/ics/): Industrial control systems — Siemens, Schneider Electric, ABB, GE, and others
- [Web servers](https://docs.nxlog.co/integrations/web-server/): Apache HTTP, Apache Tomcat, NGINX, and Microsoft IIS
- [Log formats](https://docs.nxlog.co/integrations/format/): CEF, LEEF, Syslog, Elastic Common Schema, and other standard formats

## Developer Guide

- [API overview](https://docs.nxlog.co/api/agent-management/): REST API for programmatic agent and configuration management
- [Authentication](https://docs.nxlog.co/api/agent-management/authentication.html): API authentication methods
- [Enroll agents via API](https://docs.nxlog.co/api/agent-management/enroll-agents.html): Registering agents programmatically
- [Create configurations via API](https://docs.nxlog.co/api/agent-management/create-configuration.html): Deploying agent configurations programmatically
- [API reference](https://docs.nxlog.co/api/agent-management/api-reference.html): Full REST API endpoint reference

## Optional

- [NXLog Platform release notes](https://docs.nxlog.co/platform/current/release-notes.html): What's new in each NXLog Platform release
- [NXLog Platform changelog](https://docs.nxlog.co/platform/current/changelog.html): Detailed version history with all changes
- [NXLog Platform known issues](https://docs.nxlog.co/platform/current/known-issues.html): Current NXLog Platform known limitations and workarounds
- [NXLog Agent release notes](https://docs.nxlog.co/agent/current/release-notes.html): What's new in each NXLog Agent release
- [NXLog Agent changelog](https://docs.nxlog.co/agent/current/changelog.html): NXLog Agent version history
- [NXLog Agent known issues](https://docs.nxlog.co/agent/current/known-issues.html): Current NXLog Agent known limitations and workarounds
- [Support policy](https://docs.nxlog.co/platform/current/support-policy.html): Version support lifecycle and end-of-life dates