Filebeat to match IIS logs timestamp

[alexserd (alex)]

Christian, we are using ELK + Filebeat to ingest logs from IIS server. We had an issue where the service was not running and some old IIS logs were not imported from 2 weeks ago. I've turned filebeat service and the logs got ingested but the timestamp was used as current time of import. I would like logstash to read timestamp on the actual logs. I found these articles describing similar issue I tried to follow the steps described however was not successful.

Filebeat Grok for Date IIS logs

Ahhhh. Thank you! I just learnt something new, again OK, I'll do it tomorrow morning first thing then I'll send you an update.

Filebeat Grok for Date IIS logs

Hi Noemi I ran the command you gave but got an error that --pipelines and --update-pipelines commands do not exist. However, running the below worked. D:\filebeat>filebeat setup --modules=iis_custom Loaded index template Loaded dashboards Loaded machine learning job configurations Unfortunately I am still getting the same error. I proceeded to make the log file even simpler by just leaving the date (without the time) to make it as simple as possible, but unfortunately, still the same err…