Filebeat Include filter

Elastic Stack Beats
,
1

Module: iis

Docs: IIS module | Filebeat Reference [7.16] | Elastic

  • module: iis

    Access logs

    access:
    enabled: true
    input :
    include_lines: ["MOUIAPILive","mouiapilive"]

    Set custom paths for the log files. If left empty,

    Filebeat will choose the paths depending on your OS.

    var.paths: ["C:/inetpub/logs/LogFiles/W3SVC10/*.log"]

    Error logs

    error:
    enabled: false

    Set custom paths for the log files. If left empty,

    Filebeat will choose the paths depending on your OS.

    #var.paths:

Hi Team this is my filebeat iis.yml file.here i have added include filter to get the log of particular line.
i need to get the log from an file which has both these keyword
["MOUIAPILive","mouiapilive"],
MY doubt is the include filter is case sensitive.should i add both the keywords,are single is sufficient.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.