# Data Accuracy with Filebeat/IIS Aggregation

**URL:** https://discuss.elastic.co/t/data-accuracy-with-filebeat-iis-aggregation/193409
**Category:** Beats
**Tags:** beats-module, filebeat
**Created:** [August 1, 2019, 9:31pm UTC](https://discuss.elastic.co/t/data-accuracy-with-filebeat-iis-aggregation/193409 "2019-08-01T21:31:08Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![subhashpant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/subhashpant/32/51469_2.png) [@subhashpant](https://discuss.elastic.co/u/subhashpant)
#### Post date: [August 1, 2019, 9:31pm UTC](https://discuss.elastic.co/t/data-accuracy-with-filebeat-iis-aggregation/193409/1 "2019-08-01T21:31:08Z")

</div>

I was previously parsing the IIS Log data (to get aggregate) using Log Parser 2.2. Generic command as follows:

.\logparser -rtp:-1 -i:iisw3c "SELECT TO\_LOCALTIME(QUANTIZE(TO\_TIMESTAMP(date, time), 3600)) AS [DateTime], COUNT(\*) AS [Requests] INTO HourlyDayReport\_OCSP01.txt FROM C:\DBATools\Log\u\_ex190731.log GROUP BY [DateTime] ORDER BY [DateTime]"

I installed 7.3 version of ELK stack, and using Filebeat 7.3 also. No customization, just enabled IIS module via Filebeat and data is getting ingested. The IIS Log is in W3C format, so the time is in GMT. The ingestion pipeline is IIS Logs -\> FileBeat 3.0 -\> Elastic Search 7.3. No logstash or custom parsing.

Issue:

1. During some hours, aggregates do not match by a small quantity (This did not pique my attention much, as, there could be diff between how Log Parser vs Elastic Search interprets the time). However, they are very close (interpreted in same hour - CST).
2. There are several hours on each day where aggregates (count of hits) are \< 500, but the logs have those data.

Also uploaded the raw data into Azure Data Analytics and built the same aggregation using U-SQL. This matches the result of Log Parser.

I looked into errors, nothing in ELK stack or syslog (for Kibana). It did not make sense to me why there would be a gap (i.e. if it stopped working, there would be no data beyond that point).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 29, 2019, 9:31pm UTC](https://discuss.elastic.co/t/data-accuracy-with-filebeat-iis-aggregation/193409/2 "2019-08-29T21:31:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.