I want to see the detail from my server's IIS logs , and I found that kibana cannot format the information of IIS logs. Pls tell what measure should i do ,so I can see the logs' detail. thank you
Hi @Code,
the heuristic used by the Logs UI to extract the log message attempts a few known filebeat formats and falls back to the message and @message attribute of the document. We're working on making these rules configurable.
What you're seeing indicates that the docs representing the IIS log events match neither of these rules. While we're working on improving filebeat module compatibility, you could work around this in the meantime by copying the desired fields of the log event to the message attribute during ingestion.
Thank you, but can you tell me where is the message attribute? In other word, which .yml filed should be change?
My OS is Windows Server 2012
What I wanted to express is that the message attribute is not properly configurable at the moment. As a workaround I would recommend to make sure a message field is created on each doc during ingestion.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.