Nagios Log Server Data Sources: What Else Can You Feed It?

Perry Broste — Fri, 13 Nov 2026 17:13:00 +0000

Most people point Nagios Log Server at Windows Event Logs and Linux syslog and move on, but Log Server data sources can include almost anything that produces text. So it’s fair to ask: What else can you feed it? Short answer: anything you can get flowing into an input, whether it’s a standard log source or some creatively repurposed feed.

Options for Incoming Log Server Data Sources

Event Logs

Start with the obvious: Windows Event Logs (via NXLog), security events, and application event streams. These are the bread and butter of correlation and compliance, and they are the easiest win for alerting on specific event IDs. You can find more information in the Admin Guide:

Sending Windows Logs To Nagios Log Server

System Logs

Linux/UNIX syslog, network device logs from switches and firewalls, and OS-level messages. Pointing the rsyslog daemon at the Log Server TCP/UDP input is a one-line config change on the sending host. This section of the Admin Guide shows how to monitor a new log source:

Monitoring A New Log Source

Get Creative With Custom Feeds

This is where thinking outside of the box comes in handy. Log Server data sources don’t have to be logs at all. You can use Log Server as a general-purpose event pipeline. Since Log Server indexes and stores any text that comes in, you can just script a small poller to pull RSS, HTTP, or JSON feeds and push them in as regular log events.

Install Logstash RSS Plugin

Before adding an RSS feed, install the Logstash RSS input plugin from shell:

sudo /usr/local/nagioslogserver/logstash/bin/logstash-plugin install logstash-input-rss logstash-filter-xml

sudo /usr/local/nagioslogserver/logstash/bin/logstash-plugin install logstash-input-rss logstash-filter-xml

Configure Input

Next, log in to your Log Server and go to Admin > Logstash Configuration > Global Config, click the Add Input button, and add a new input with the feed URL and polling interval. Click Verify then Save.

For detailed steps on configuring inputs, see Nagios Log Server Configuring Inputs.

Adding an RSS input to pull a national weather news feed.

Logstash Input:

rss {
    id => "noaa-weather-obs"
    url => "https://forecast.weather.gov/xml/current_obs/KSTP.rss"
    interval => 200
    tags => ["noaa", "weather", "data"]
  }

rss {
    id => "noaa-weather-obs"
    url => "https://forecast.weather.gov/xml/current_obs/KSTP.rss"
    interval => 200
    tags => ["noaa", "weather", "data"]
  }

interval sets how often, in seconds, Log Server checks the feed. tags labels the events so you can filter and search for them.

Configure Filter

Next, set up a filter to parse the log data and turn it into something structured and queryable.

For detailed steps on configuring filters, see Nagios Log Server Configuring Input Filters.

A filter that cleans up the feed data and extracts condition, temperature, and location fields.

Logstash Filter:

mutate {
    gsub => [
      "message",
      ']*>.*?<br\s*/?>\s*\n?',
      ''
    ]
  }

  grok {
    match => {
    "title" => "%{WORD:condition} and %{NUMBER:temperature} %{WORD:unit} at %{GREEDYDATA:location}"
  }
  }

mutate {
    gsub => [
      "message",
      ']*>.*?\s*\n?',
      ''
    ]
  }

  grok {
    match => {
    "title" => "%{WORD:condition} and %{NUMBER:temperature} %{WORD:unit} at %{GREEDYDATA:location}"
  }
  }

Example Dashboard Results

Nagios Log Server Results: All Events list showing weather details from an RSS feed

Ideas to Poll and Why

Weather: Ingest NOAA or a local weather API on a schedule; alert when a storm cell or extreme temperature hits your data center ZIP code so the network operations center (NOC) is pre-warned before a power event.
Sports: Pipe your team’s game feed into Log Server and build a dashboard that pings you on scores. Sounds silly, but it’s a great way to show a stakeholder that custom queries and dashboards actually work — without having to walk them through a dry infra demo.
Tech: Pull a tech news RSS feed into the same index as your infra logs. Then when something breaks, you can search back and see what else was going on at the time, like a service outage or a known CVE that lines up with the incident window.
Internal company data: Send company channel chats, Git bug reports, and support cases into Logstash so they’re searchable and can trigger alerts. Before indexing internal data, check with your security and compliance teams, and limit access to those indices to the users who need it.
Alien sightings: The unusual one that makes the point: add a UFO-reporting RSS feed (e.g., a public sighting feed) to your Log Server data sources and you now have a fully indexed, queryable, alertable “extraterrestrial event” stream that can even be displayed on a world map. If Nagios Log Server can handle this type of data, it can handle your next unusual data source.

Conclusion

Your Log Server data sources don’t have to stop at syslog. Nagios Log Server is a general-purpose ingestion and indexing engine, so anything with a text representation, such as structured logs, JSON, or RSS and Atom feeds, can become a queryable, alertable, archived stream. Those creative feeds aren’t a gimmick; they prove the input layer is genuinely open. Found an unusual data source that works? Share it with the Nagios Community on r/nagios, or tag us on LinkedIn or Facebook.

Perry Broste – Nagios Library