Failed to format message from *

(Raymond Pan) #1

I want to see the detail from my server's IIS logs , and I found that kibana cannot format the information of IIS logs. Pls tell what measure should i do ,so I can see the logs' detail. thank you

(Felix Stürmer) #2

Hi @Code,

the heuristic used by the Logs UI to extract the log message attempts a few known filebeat formats and falls back to the message and @message attribute of the document. We're working on making these rules configurable.

What you're seeing indicates that the docs representing the IIS log events match neither of these rules. While we're working on improving filebeat module compatibility, you could work around this in the meantime by copying the desired fields of the log event to the message attribute during ingestion.

(Raymond Pan) #3

Thank you, but can you tell me where is the message attribute? In other word, which .yml filed should be change?

(Raymond Pan) #4

My OS is Windows Server 2012

(Felix Stürmer) #5

What I wanted to express is that the message attribute is not properly configurable at the moment. As a workaround I would recommend to make sure a message field is created on each doc during ingestion.