# Filebeat running but now showing iis logs in elasticsearch

**URL:** <https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 9, 2021, 3:56am UTC](https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701 "2021-11-09T03:56:48Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mehmood1](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@mehmood1](https://discuss.elastic.co/u/mehmood1)\
**Post date:** [November 9, 2021, 3:56am UTC](https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701/1 "2021-11-09T03:56:48Z")

</div>

filebeat and elasticsearch running but now showing iis logs in in browser

url [http://172.xx.x.xxx:9200/filebeat-\*/\_count?pretty](http://172.xx.x.xxx:9200/filebeat-*/_count?pretty)  
below is my config files

{  
"count" : 0,  
"\_shards" : {  
"total" : 0,  
"successful" : 0,  
"skipped" : 0,  
"failed" : 0  
}  
}

iis yml file-----------------

- 
  - module: iis

- 
# Access logs
- access:

- 

```
enabled: true

```

- 

```
# Set custom paths for the log files. If left empty,

```

- 

```
# Filebeat will choose the paths depending on your OS.

```

- 

```
var.paths: ["C:/inetpub/logs/LogFiles/*/*.log"]

```

- 
# Error logs
- error:

- 

```
enabled: true

```

- 

```
# Set custom paths for the log files. If left empty,

```

- 

```
# Filebeat will choose the paths depending on your OS.

```

- 

```
var.paths: ["C:/Windows/System32/LogFiles/HTTPERR/*.log"]

```

- 

```
#["C:\inetpub\logs"]

```

filebeat yml file ----------------

- filebeat.inputs:

- 
  - type: log

- enabled: true

- 

```
- /var/log/*.log

```

- 

```
#- c:\programdata\elasticsearch\logs\*

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 9, 2021, 3:57am UTC](https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701/2 "2021-11-09T03:57:15Z")

</div>

Welcome to our community! 😃

Please don't post pictures of text, logs or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂

---

<div class="post-metadata">

**Author:** ![mehmood1](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@mehmood1](https://discuss.elastic.co/u/mehmood1)\
**Post date:** [November 9, 2021, 4:00am UTC](https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701/3 "2021-11-09T04:00:02Z")

</div>

may i remove this post?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 9, 2021, 4:00am UTC](https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701/4 "2021-11-09T04:00:31Z")

</div>

Do you no longer need this thread?

---

<div class="post-metadata">

**Author:** ![mehmood1](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@mehmood1](https://discuss.elastic.co/u/mehmood1)\
**Post date:** [November 9, 2021, 4:01am UTC](https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701/5 "2021-11-09T04:01:58Z")

</div>

i need it but i mean ......i can post with out images.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 9, 2021, 4:02am UTC](https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701/6 "2021-11-09T04:02:49Z")

</div>

Ok, just edit your post, or add it below 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2021, 4:03am UTC](https://discuss.elastic.co/t/filebeat-running-but-now-showing-iis-logs-in-elasticsearch/288701/7 "2021-12-07T04:03:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.