Filebeat IIS Access logs not parsing but Error logs are

Elastic Stack Beats
1

I have enabled Filebeat module for IIS logging for IIS 7.5 but I'm not seeing the access logs parsed. The error logs are getting parsed just fine but the access log don't and give me an error.message of "Provided Grok expressions do not match field value: ...". Since this is enabled from the module, is there any additional settings I need to modify? I'm on version 7.6.

2

Reinstalling filebeat fixed this and I'm not getting the error message now.

3

Thanks for reporting the fix, maybe it was a version mismatch?

4

I reinstalled the same version. It was only setup a few months ago so the original person may have done something different doing the first install???

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.