_grokparsefailure tag errors parsing IIS logs using FileBeat

You'll want to change %{WORD:serverName} to e.g. %{NOTSPACE:serverName} because WORD doesn't include hyphens (IIRC).

But in general, never try the full expression at once. Start with the smallest possible expression, in this case %{TIMESTAMP_ISO8601:log_timestamp}, and gradually add more and more until things stop working. Then you know that the most recent addition was wrong.

1 Like