# Filebeat to match IIS logs timestamp **URL:** \ **Category:** Beats\ **Created:** [November 26, 2019, 6:49pm UTC](https://discuss.elastic.co/t/filebeat-to-match-iis-logs-timestamp/209565 "2019-11-26T18:49:29Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![alexserd](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@alexserd](https://discuss.elastic.co/u/alexserd)\ **Post date:** [November 27, 2019, 6:27pm UTC](https://discuss.elastic.co/t/filebeat-to-match-iis-logs-timestamp/209565/3 "2019-11-27T18:27:21Z")
Christian, we are using ELK + Filebeat to ingest logs from IIS server. We had an issue where the service was not running and some old IIS logs were not imported from 2 weeks ago. I've turned filebeat service and the logs got ingested but the timestamp was used as current time of import. I would like logstash to read timestamp on the actual logs. I found these articles describing similar issue I tried to follow the steps described however was not successful. > [@Filebeat Grok for Date IIS logs](https://discuss.elastic.co/t/filebeat-grok-for-date-iis-logs/147659/9): > > Ahhhh. Thank you! I just learnt something new, again slight_smile OK, I'll do it tomorrow morning first thing then I'll send you an update. > [@Filebeat Grok for Date IIS logs](https://discuss.elastic.co/t/filebeat-grok-for-date-iis-logs/147659/10): > > Hi Noemi I ran the command you gave but got an error that --pipelines and --update-pipelines commands do not exist. However, running the below worked. D:\filebeat\>filebeat setup --modules=iis\_custom Loaded index template Loaded dashboards Loaded machine learning job configurations Unfortunately I am still getting the same error. I proceeded to make the log file even simpler by just leaving the date (without the time) to make it as simple as possible, but unfortunately, still the same err… --- _[View the full topic](https://discuss.elastic.co/t/filebeat-to-match-iis-logs-timestamp/209565)._