# Can't parse the destination address in an iis log

**URL:** <https://discuss.elastic.co/t/cant-parse-the-destination-address-in-an-iis-log/65919>\
**Category:** Logstash\
**Created:** [November 13, 2016, 10:37pm UTC](https://discuss.elastic.co/t/cant-parse-the-destination-address-in-an-iis-log/65919 "2016-11-13T22:37:13Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![relentless](https://avatars.discourse-cdn.com/v4/letter/r/a8b319/32.png) [@relentless](https://discuss.elastic.co/u/relentless)\
**Post date:** [November 13, 2016, 10:37pm UTC](https://discuss.elastic.co/t/cant-parse-the-destination-address-in-an-iis-log/65919/1 "2016-11-13T22:37:13Z")

</div>

I'm trying to start a what feels like simple parse of an iis log file. Initially I just stole an example grok filter from google and after puzzling over the parse errors for the a while decided to start fresh.  
Its a default iis log.  
I start the filter with %{TIMESTAMP\_ISO8601:log\_timestamp} and I can see this in logstash fine. Then the second part is the destination address which I use %{IPORHOST:site} and in logstash I see the error  
failed to parse [site], caused by =\>type illegal argument exception. invalid formation "10.20.30.100" is malformed at ".20.30.100"  
Its really doing my head in, I've looked at the bunch of other examples and everyone else seems fine. Its like theres a config I'm missing that everyone else knows. This is using elk 5.0.0 btw.  
config file is below

input {  
beats {  
port =\> 5044  
type =\> "logs"  
}  
}  
filter {  
if [message] =~ "^#"{  
drop {}  
}  
grok {  
match =\> ["message", "%{TIMESTAMP\_ISO8601:log\_timestamp} %{IPORHOST:site}"]  
}  
}  
output {  
elasticsearch {  
hosts =\> "localhost:9200"  
user =\> xxxx  
password =\> "xxxxxx"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 13, 2016, 11:23pm UTC](https://discuss.elastic.co/t/cant-parse-the-destination-address-in-an-iis-log/65919/2 "2016-11-13T23:23:09Z")

</div>

It'd help if you also provided a log sample.

---

<div class="post-metadata">

**Author:** ![relentless](https://avatars.discourse-cdn.com/v4/letter/r/a8b319/32.png) [@relentless](https://discuss.elastic.co/u/relentless)\
**Post date:** [November 14, 2016, 12:07am UTC](https://discuss.elastic.co/t/cant-parse-the-destination-address-in-an-iis-log/65919/3 "2016-11-14T00:07:41Z")

</div>

Ah yep sorry. Heres an example line  
2016-10-27 02:00:46 10.20.30.100 POST /webservice.svc - 80 domain\user 10.20.30.101 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.3;+WOW64;+Trident/7.0;+.NET4.0E;+.NET4.0C;+.NET+CLR+3.5.30729;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.30729;+InfoPath.3) [http://hostname/folder/webpage.xap](http://hostname/folder/webpage.xap) 200 0 0 257

I've run it through the grok debugger and can pull the data no problems.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 14, 2016, 9:31am UTC](https://discuss.elastic.co/t/cant-parse-the-destination-address-in-an-iis-log/65919/4 "2016-11-14T09:31:33Z")

</div>

This rather looks like an issue with the ES mappings. What are the mappings of your index? Specifically, what's the mapping of the `site` field?

---

<div class="post-metadata">

**Author:** ![relentless](https://avatars.discourse-cdn.com/v4/letter/r/a8b319/32.png) [@relentless](https://discuss.elastic.co/u/relentless)\
**Post date:** [November 14, 2016, 7:51pm UTC](https://discuss.elastic.co/t/cant-parse-the-destination-address-in-an-iis-log/65919/5 "2016-11-14T19:51:07Z")

</div>

It does say I have a conflict for the site mapping. Though it could be because I've attempted so many different ways of doing the same thing have log entries with them now. I was able to get it to parse if I specifically used %{IPV4:site} rather than %{IPORHOST:site} but from what I can see in the default grok patterns its kinda of the same thing if its an ipv4 address.

I removed the offending indexes and have refreshed the fields which removed the conflict. So its just showing site as a string now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2016, 7:51pm UTC](https://discuss.elastic.co/t/cant-parse-the-destination-address-in-an-iis-log/65919/6 "2016-12-12T19:51:16Z")

</div>

Closed on December 12, 2016, 7:51pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.