Internal Metrics (im_internalmetrics)

This module allows you to collect metrics from your NXLog instance. Metrics include counters for global, module, and route operations, such as received, forwarded, and dropped events.

Configuration

The im_internalmetrics module accepts the following directives in addition to the common module directives.

Required directives

You must specify at least one of these directives for the module to start.

CounterModule

Use this directive to collect metrics for a specific module instance. It generates metrics using the naming convention <instancename>_<metricname>. You can specify this directive multiple times, once for each module instance.

If a module instance is also part of a route requested by the CounterRoute directive, the metric will be logged once using the route metric naming convention.

CounterRoute

Use this directive to collect metrics for a specific route and all its module instances. It generates route metrics using the naming convention <routename>_<metricname> and module metrics using the naming convention <routename>_<modulename>_<metricname>. You can specify this directive multiple times, once for each route.

CounterServer

Boolean directive to specify whether to collect global NXLog instance metrics, such as system information, resource usage, labels, and a list of extension modules used in the configuration. The default is FALSE.

Optional directives

PollInterval

Specify the polling interval in seconds. The minimum value is 2 seconds. The default is 60 seconds.

Fields

The following fields are used by im_internalmetrics.

$raw_event (type: string): A list of metrics in key-value pair format.

Examples

Example 1. Collecting and forwarding route metrics in JSON format

This configuration collects syslog messages from a file and forwards them to a SIEM over TCP. It also collects metrics from this route and forwards them to an observability platform in JSON format.

nxlog.conf

<Extension json>
        Module  xm_json
</Extension>

<Input system_logs>
    Module          im_file
    File            '/var/log/syslog'
</Input>

<Output siem>
    Module          om_tcp
    Host            192.168.1.123:514
</Output>

<Route logs_route> (1)
    Path            system_logs => siem
</Route>

<Input nxlog> (2)
    Module          im_internalmetrics
    CounterRoute    logs_route 
</Input>

<Output metrics_output>
    Module          om_tcp
    Host            192.168.1.124:3000
    Exec            to_json(); (3)
</Output>

<Route metrics_route> (4)
    Path            nxlog => metrics_output
</Route>

1	The `logs_route` route forwards the syslog messages to a SIEM.
2	This im_internalmetrics instance collects metrics from the `logs_route` route.
3	Converts the metrics to JSON using the xm_json module to_json() procedure.
4	The `metrics_route` route forwards the metrics to an observability platform.

Output sample

{
  "logs_route_system_logs_evt_recvd": 50,
  "logs_route_system_logs_evt_recvd_reroute": 0,
  "logs_route_system_logs_evt_drop": 0,
  "logs_route_system_logs_evt_fwd": 50,
  "logs_route_system_logs_batchsize": 50,
  "logs_route_system_logs_status": "RUNNING",
  "logs_route_system_logs_type": "INPUT",
  "logs_route_system_logs_module": "im_file",
  "logs_route_system_logs_variables": 0,
  "logs_route_siem_evt_recvd": 50,
  "logs_route_siem_evt_recvd_reroute": 0,
  "logs_route_siem_evt_drop": 0,
  "logs_route_siem_evt_fwd": 50,
  "logs_route_siem_queuesize": 0,
  "logs_route_siem_queuelimit": 2097152,
  "logs_route_siem_queuerecordcount": 0,
  "logs_route_siem_status": "RUNNING",
  "logs_route_siem_type": "OUTPUT",
  "logs_route_siem_module": "om_tcp",
  "logs_route_siem_variables": 0,
  "logs_route_evt_recvd": 50,
  "logs_route_evt_recvd_reroute": 0,
  "logs_route_evt_drop": 0,
  "logs_route_evt_loss_flowcontrol": 0,
  "logs_route_evt_loss_reroute": 0,
  "logs_route_evt_fwd": 50,
  "logs_route_evt_fwd_reroute": 0,
  "logs_route_in_use": true,
  "EventReceivedTime": "2025-06-17T16:33:45.870120+03:00",
  "SourceModuleName": "nxlog",
  "SourceModuleType": "im_internalmetrics",
  "Hostname": "SERVER01"
}

Example 2. Collecting and forwarding metrics as raw key-value pairs

This configuration generates logs with the im_testgen input module and routes them to an om_null output instance. It also collects metrics from this route and saves them to a file in the raw key-value pair format.

nxlog.conf

<Input testgen>
    Module           im_testgen
    MaxCount         100
</Input>

<Output null>
    Module           om_null
</Output>

<Route test_route> (1)
    Path             testgen => null
</Route>

<Input nxlog> (2)
    Module           im_internalmetrics
    CounterRoute     test_route
    CounterModule    testgen
    CounterModule    null
</Input>

<Output metrics_output>
    Module           om_file
    File             '/var/log/nxlog_metrics'
</Output>

<Route metrics_route> (3)
    Path             nxlog => metrics_output
</Route>

Output sample

2025-06-17 16:21:32 SERVER01 INFO test_route_testgen_evt_recvd="100" test_route_testgen_evt_recvd_reroute="0" test_route_testgen_evt_drop="0" test_route_testgen_evt_fwd="100" test_route_testgen_batchsize="50" test_route_testgen_status="RUNNING" test_route_testgen_type="INPUT" test_route_testgen_module="im_testgen" test_route_testgen_variables="0" test_route_null_evt_recvd="100" test_route_null_evt_recvd_reroute="0" test_route_null_evt_drop="0" test_route_null_evt_fwd="100" test_route_null_queuesize="0" test_route_null_queuelimit="2097152" test_route_null_queuerecordcount="0" test_route_null_status="RUNNING" test_route_null_type="OUTPUT" test_route_null_module="om_null" test_route_null_variables="0" test_route_evt_recvd="100" test_route_evt_recvd_reroute="0" test_route_evt_drop="0" test_route_evt_loss_flowcontrol="0" test_route_evt_loss_reroute="0" test_route_evt_fwd="100" test_route_evt_fwd_reroute="0" test_route_in_use="TRUE"

1	The `test_route` route forwards the generated logs to an om_null instance.
2	This im_internalmetrics instance collects metrics from the `test_route` route and `testgen` and `null` module instances. Since the modules belong to the `test_route` route, the module will generate metrics for them in the route format.
3	The `metrics_route` route outputs the metrics to a file.