# Filebeat - IIS Module Questions (search, pipeline, grok)

**URL:** <https://discuss.elastic.co/t/filebeat-iis-module-questions-search-pipeline-grok/183333>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [May 29, 2019, 12:48pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-questions-search-pipeline-grok/183333 "2019-05-29T12:48:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![itguy\_chris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/itguy_chris/32/47087_2.png) [@itguy\_chris](https://discuss.elastic.co/u/itguy_chris)\
**Post date:** [May 29, 2019, 12:48pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-questions-search-pipeline-grok/183333/1 "2019-05-29T12:48:56Z")

</div>

Hi All,  
Using ES 7.0, FB 7.0 using just the IIS Module for now...

I have a few questions:

1. The field iis.access.cookie; I am trying to figure out in Kibana how to search (under discovery)  
for the context of the ASP.NET\_SessionID; I do not seem to get accurate results as I am not sure in KQL on how to format the inquiry.

2. It might be easier to search for that overall if I could isolate that information into another field. I understand this is a Grok thing. How would I modify the exisitng pipeline and add the seperation of that specific content to a new field? I hope I am saying this right.

Thanks - Chris

Example Data:

> iis.access.cookie \_fbp=fb.1.155913338009518.173243619;+\_\_utmc=154350649;+\_\_utmz=15439050649.1559133380.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(organic);+\_ga=GA1.2.1801919158.1559133381;+\_gat\_UA-12435659-3=1;+\_gcl\_au=1.1.1893700599.1559133380;+\_gid=GA1.2.5291068339.1559133381;+EnhancedSchematics=dpouspm;+PSHotSpots=wbsjbujpo;+PageViewCount=2;+SearchSession\_LT=7f845684-4c98-1179-2c24-669ffb8e2216;+SearchSession\_LT\_Count=1;+acqData=%8C%33dbnqbjho%33%4B%33%39ejsfdu%3a%33%3D%33tpvsdf%33%4B%33%39ejsfdu%3a%33%3D%33nfejvn%33%4B%33%39pshbojd%3a%33%3D%33dpoufou%33%4Bovmm%3D%33ufsn%33%4Bovmm%8E;+chref=/Frigidaire-Refrigerator-Motors.htm;+not\_use\_hotspots=fobcmf;+ASP.NET\_SessionId=iuwfs2vkxxtdgplw45nrknlw;+GABRAND=Bob

pipeline viewed in Kibana  
{  
"filebeat-7.0.1-iis-error-default" : {  
"description" : "Pipeline for parsing IIS error logs. Requires the geoip plugin.",  
"processors" : [  
{  
"grok" : {  
"field" : "message",  
"patterns" : [  
"%{TIMESTAMP\_ISO8601:iis.error.time} %{IPORHOST:source.address} %{NUMBER:source.port:long} %{IPORHOST:destination.address} %{IPORHOST:destination.port:long} (?:HTTP/%{NUMBER:http.version}|-) (?:%{WORD:http.request.method}|-) (?:%{URIPATHPARAM:url.original}|-)(?: -)? (?:%{NUMBER:http.response.status\_code:long}|-) (?:%{NUMBER}|-) (?:%{NOTSPACE:iis.error.reason\_phrase}|-) (?:%{NOTSPACE:iis.error.queue\_name}|-)"  
],  
"ignore\_missing" : true  
}  
},  
{  
"remove" : {  
"field" : "message"  
}  
},  
{  
"rename" : {  
"field" : "@timestamp",  
"target\_field" : "event.created"  
}  
},  
{  
"date" : {  
"formats" : [  
"yyyy-MM-dd HH:mm:ss"  
],  
"field" : "iis.error.time",  
"target\_field" : "@timestamp"  
}  
},  
{  
"remove" : {  
"field" : "iis.error.time"  
}  
},  
{  
"grok" : {  
"field" : "destination.address",  
"patterns" : [  
"%{NOZONEIP:destination.ip}"  
],  
"pattern\_definitions" : {  
"NOZONEIP" : "[^%]_"  
}  
}  
},  
{  
"grok" : {  
"field" : "source.address",  
"patterns" : [  
"%{NOZONEIP:source.ip}"  
],  
"pattern\_definitions" : {  
"NOZONEIP" : "[^%]_"  
}  
}  
},  
{  
"geoip" : {  
"field" : "source.ip",  
"target\_field" : "source.geo",  
"ignore\_failure" : true  
}  
}  
],  
"on\_failure" : [  
{  
"set" : {  
"value" : "{{ \_ingest.on\_failure\_message }}",  
"field" : "error.message"  
}  
}  
]  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2019, 12:49pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-questions-search-pipeline-grok/183333/2 "2019-06-26T12:49:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.