Filebeat IIS Module

MoeAly · September 23, 2020, 10:47pm

Hello Everyone,

I'm using Filebeat's iis module to ingest IIS logs into ES.

All is going well and I'm able to successfully ingest my logs into ES.

However, there is an iis data field called x-forwarded-for that is not recognized by Filebeat and does not get parsed/ingested into ES. A quick Google search shows that this field was not supported by Filebeat as of late 2018. Has this changed at all with the latest release of Filebeat?? Is anyone aware of a way around this? Perhaps to edit the fields.yml file manually to include this missing field? Any help/suggestions are greatly appreciated!

Thanks All!

kvch · September 25, 2020, 2:27pm

It is not supported by Filebeat. Is this some kind of custom log format you are using? If not, do you mind opening an enhancement request on Github?

system · October 23, 2020, 2:27pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Filebeat with IIS logs Beats filebeat	2	432	January 10, 2020
X-Forwarded Headers with IIS Module Beats filebeat	4	2519	August 16, 2018
Unable to get X-Forwarded-For to display Elasticsearch	7	1370	December 17, 2020
Filebeat 6.3+ IIS module and IIS versions < 10 Beats filebeat	2	442	October 1, 2018
FileBeat not forwarding My IIS logs to elastic search Logs	7	3339	April 4, 2019

Filebeat IIS Module

Related topics