Configuration problem

Elastic Stack Beats
1

Hello

I have a problem with filebeat configuration. When paths configuration looks like this all works fine (index created document indexed):
paths:
- C:\Users\pawnow\logstash\iis-log.log

However I need to parse iis log files. I enabled iis module ("filebeat modules list" says "Enabled iis"). When I have iis module enabled filebeat ignores paths in filebeat.yml and uses these in "modules.d\iis.yml" (please correct me if I'm wrong).
Content of iis.yml is:

  • module: iis
    access:
    enabled: true
    #var.paths: ["C:/inetpub/logs/LogFiles//.log"]
    error:
    enabled: true

The result is no index and no documents. I use the same single file in both cases. After that registry files contains entry for iis-log.log What am I doing wrong?

2

Hi @waitangi,

If you want to use the module for our logs, you can edit modules.d\iss.yml and update var.paths to your custom paths. There is no need to make changes in the filebeat.yml file.

Best regards

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.