Filebeat with IIS logs

[Aleix_Abrie_Prat]

Hi everyone,

I have a doubt with the module for IIS logs. I configured the output of filebeat to connect directly with the elasticsearch and then I've have done the command ".\filebeat.exe setup to make the index in elasticsearch and the dashboards in kibana. But i have a problem...

With the index created automatically, the index doesn't have a field for the IP that comes from "X Forwarded for". Now, my question is:

Can i update the pipeline that parses the IIS logs to add the field for this IP?

Thanks for advance

[ChrsMark (Chris Mark)]

Hi!

You can find the fields that are exported here.

If the filed you are looking for is not listed you can use an extra processor like [https://www.elastic.co/guide/en/beats/filebeat/master/processor-script.html](https://www.elastic.co/guide/en/beats/filebeat/master/processor-script.html)script-processor to further analyse the events.

If you think this field is important enough you can open a Github issue requesting for it (or if you want you can contribute it directly ).

Thanks!