Import logs from any source with EventLog Analyzer

What is event log import?

Importing event logs means taking existing log files from any accessible location into your log management solution. The solution identifies the format automatically, extracts the fields, associates the data with a device, and makes it searchable and reportable. EventLog Analyzer supports Windows event log management along with syslog, application, database, and archived log formats, so you can centrally analyze data from any source.

Why import logs instead of only collecting them live?

• Historical and forensic analysis: Re-import archived or exported logs to investigate past incidents.
• Offline sources: Analyze logs from systems that can't stream events to a collector.
• Third-party and legacy formats: Bring in logs from applications and databases that don't support real-time forwarding.
• Compliance and audit evidence: Recover archived logs into the console when auditors need them.

How EventLog Analyzer imports your log files

EventLog Analyzer brings your log files into a single Import Log Source Configuration page with automatic format detection and built-in field extraction. There are two methods to reach it.

Method 1: + Add > Import Logs

Method 2: Settings > Log Source Configurations > Import Logs

Once a log file is selected, EventLog Analyzer can automatically identify the log format or you can choose it manually. You can preview the file, extract the exact fields you need, and associate the logs with the correct device before the import runs.

Advanced import options

EventLog Analyzer makes bulk and ad hoc imports fast and low-effort:

• Multiple files at once: Select several log files and import them in a single Import Log Source Configuration page.
• Select folder option: Pull in every file from a folder at once, straight from the file browser.
• Quick Import: Import files without specifying a log type. EventLog Analyzer identifies the type automatically, and if it can't be identified, it creates a new format and applies the default parser rules to the imported files.

Multiple supported protocols

Import log files to the EventLog Analyzer server from your local host machine or any remote machine. EventLog Analyzer supports a wide range of transfer protocols such as FTP, SFTP, SCP, SMB, HTTP, HTTPS, FILE, and UNC paths.

You can also import log files stored online simply by providing a URL. Remote imports support authentication by username and password or, for SFTP, an OpenSSH private key file with optional passphrase protection.

Import log files from any location

EventLog Analyzer supports four import sources, so you can pull logs in regardless of where they live.

1. Local path: Import log files from any device that has access to EventLog Analyzer. Browse and select the file directly, or specify the device name, IP address, or full UNC path. This is the fastest way to bring in a one-off file.

Note: Local-path imports cannot be scheduled to run at regular intervals.

2. Shared path (UNC/SMB)

Access shared network folders across your LAN using the UNC path. Enter the device name or IP address, browse to the shared folder, and select the file. Shared-path imports can be scheduled and can follow a filename pattern, so recurring files are picked up automatically.

3. Remote path (FTP/SFTP)

Pull log files from remote servers with authentication using one of two methods:

• Username and password over FTP or SFTP.
• SSH private key file (SFTP only), in OpenSSH key format, with optional passphrase protection. (Default SFTP port: 22.)

Remote imports support custom ports, scheduling, and filename patterns for automated, recurring collection.

4. Cloud storage (AWS S3)

Import logs directly from Amazon Simple Storage Service (AWS S3) buckets. Create an IAM user with access to the bucket(s), add your AWS account using a display name, access key, and secret key, select the bucket, and import. IAM policies let you scope access to specific buckets.

Advanced scheduling options

EventLog Analyzer goes one step further and automates log importing entirely. With advanced scheduling, you can pick any date, month, and time of day, down to the millisecond, and build a profile to import files periodically. Once set, the schedule runs on its own, removing a repetitive manual task from your routine.

Dynamic filename patterns

When creating an import profile, enter the filename pattern manually or select one from a list of predefined patterns. EventLog Analyzer also features dynamic filename patterning, so you can build custom patterns for unusual log filenames. Patterns can contain numbers and dates, including the day, hour, minute, or even millisecond, so each newly generated file is matched the moment it appears.

Real-time progress

Track every import as it happens. A progress bar reports the status of the log import in real time, and the advanced summary report page gives a quick synopsis of which logs have been imported, along with their creation times.

Supported log formats

EventLog Analyzer recognizes a broad range of formats on import, so data from across your environment lands in one consistent view.

Windows and syslog device formats: Windows event log (EVTX), IBM AS/400, and Linux/Unix syslog server (RFC 5424 and RFC 2131).

Importing EVT logs (Windows XP/2003): Convert the EVT file to EVTX first, using wevtutil export-log application.evt application.evtx /lf in your EventLog Analyzer installation.

Application log formats: Apache access, DHCP Linux, DHCP Windows, IBM Maximo, IIS W3C FTP, IIS W3C web server, Microsoft SQL Server, MySQL, PostgreSQL, ADAudit Plus, ADManager Plus, ADSelfService Plus, ITOM solutions, and ServiceDesk Plus.

Archived file formats: Cisco, syslog, and Windows archive files.

Importing logs from specific applications

A few sources need a short setup step before their data can be read. EventLog Analyzer documents each one.

• MySQL: MySQL captures error logs and general logs (logon failures come from the general query log). Enable logging in my.cnf (Linux) or my.ini (Windows): set log_error=<file> for errors, and general_log_file=<file> with general_log=ON for general logs (use log=<file> for v5.1.29 and below). Restart MySQL, then choose MySQL Logs as the format on import.
• PostgreSQL: Field parsing follows the log_line_prefix value in postgresql.conf. The default '%m [%p] ' works as is; add key-value tokens (for example time_stamp=%m process_id=%p database_name=%d user_name=%u) to capture more detail.
• SAP ERP: Switch on audit logging in DEFAULT.PFL under <SAP_installed path>\sys\profile with rsau/enable = 1 and rsau/local/file = <location>/audit_00. The importing user needs read access to the audit file.
• DHCP: On Windows, share %windir%\System32\Dhcp, then import via a shared or remote path as DHCP Windows Log. On Linux, logs live in var/log/syslog or var/log/messages; redirect them to a dedicated file via dhcpd.conf and rsyslog.conf if needed.
• IBM Db2: Use the db2audit tool to set the data and archive paths, create and assign an audit policy, archive active logs, and extract them into readable files for import. Diagnostic logs (db2diag.txt) are reported too; find them through the DIAGPATH setting.
• Apache: The standard Combined Log Format omits response time and bytes received, leaving some Apache Overview widgets blank. Append %{ms}T and %I to Apache's log format. EventLog Analyzer parses the extended version by default (requires mod_log_io):

%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-agent}i" %{ms}T %I

How to import a log file in EventLog Analyzer

1. Open the import console via + Add > Import Logs (or Settings > Log Source Configurations > Import Log Data).
2. Choose a source: Local Path, Shared Path, Remote Path, or Cloud, and select your file(s) or a whole folder.
3. Choose the log format, or let Quick Import identify it.
4. Attach the file to its device with the + button.
5. Set the retention period. By default, imported logs are retained for two days when Store Logs for Short Term is selected. For recurring jobs, also specify a schedule and filename pattern.
6. Click Import and follow the progress bar to completion.

Why use EventLog Analyzer to import and analyze your logs

Real-time log analysis helps you monitor what's happening across your environment, identify security threats, detect anomalous activity, and troubleshoot issues as they occur. However, important evidence can also reside in logs generated days, weeks, or months ago. These archived logs are often essential for forensic investigations, audits, compliance requirements, and root cause analysis.

EventLog Analyzer lets you import saved log files and analyze historical data alongside your live logs. Imported logs go through the same processing pipeline as collected logs, enabling you to search, correlate, report on, and analyze historical data without using a separate tool or workflow.

• Import logs from multiple sources: Import log files from local machines, network shares, remote servers, URLs, and AWS S3 buckets.
• Support multiple log formats: Import Windows event logs, syslog, application logs, database logs, and other archived log formats.
• Create custom parsers: When a log format isn't recognized, create a custom parser and define parsing rules to extract the required fields.
• Import logs in bulk: Import multiple files or entire folders to process large volumes of archived logs efficiently.
• Schedule recurring imports: Automate recurring imports using scheduled tasks and dynamic filename patterns.
• Support audits and compliance: Recover archived logs when required for audits, investigations, or compliance reviews, and use summary reports to track imported files.
• Preview and customize log fields: Preview files before importing them and configure custom patterns to extract the required data fields.

Whether you need to investigate an incident using archived logs or regularly process historical log data, EventLog Analyzer helps you bring stored logs into your existing log analysis workflow.

Frequently asked questions about importing event logs