# Filebeat IIS Access logs not parsing but Error logs are

**URL:** <https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 16, 2020, 4:59pm UTC](https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345 "2020-06-16T16:59:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [June 16, 2020, 4:59pm UTC](https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345/1 "2020-06-16T16:59:32Z")

</div>

I have enabled Filebeat module for IIS logging for IIS 7.5 but I'm not seeing the access logs parsed. The error logs are getting parsed just fine but the access log don't and give me an error.message of "Provided Grok expressions do not match field value: ...". Since this is enabled from the module, is there any additional settings I need to modify? I'm on version 7.6.

---

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [June 16, 2020, 8:53pm UTC](https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345/2 "2020-06-16T20:53:22Z")

</div>

Reinstalling filebeat fixed this and I'm not getting the error message now.

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [June 17, 2020, 9:07am UTC](https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345/3 "2020-06-17T09:07:42Z")

</div>

Thanks for reporting the fix, maybe it was a version mismatch?

---

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [June 17, 2020, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345/4 "2020-06-17T14:08:26Z")

</div>

I reinstalled the same version. It was only setup a few months ago so the original person may have done something different doing the first install???

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2020, 4:08pm UTC](https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345/5 "2020-07-15T16:08:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.