# Foilebeat IIS Module Config

**URL:** <https://discuss.elastic.co/t/foilebeat-iis-module-config/345325>\
**Category:** Kibana\
**Created:** [October 18, 2023, 8:40pm UTC](https://discuss.elastic.co/t/foilebeat-iis-module-config/345325 "2023-10-18T20:40:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [October 18, 2023, 8:40pm UTC](https://discuss.elastic.co/t/foilebeat-iis-module-config/345325/1 "2023-10-18T20:40:51Z")

</div>

I am working on version 8.10.2 of Elastic, Kibana and Filebeat. I am trying to get IIS.YML to work but I am running into a some errors.

I am running this command:  
.\filebeat.exe -e -c D:\Filebeat\modules.d\iis.yml and I am getting this error:

Exiting: no outputs are defined, please define one under the output section.

Can someone help me figure out the issue?  
Here is my IIS.YML

````auto
# Docs: https://www.elastic.co/guide/en/beats/filebeat/8.10/filebeat-module-iis.html
- module: iis
  # Access logs
  access:
    enabled: "true"
    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
  var.paths: ["D:/01-evidence/IIS/*.log"]
  # Error logs
  error:
    enabled: false
    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    # var.paths:
# =============================== Kibana ===============================
# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
- setup.kibana.host: "http://localhost:5601"
  #hosts: ["https://localhost:9200", "https://1.1.1.1:9200"]
  # Kibana Space ID
  # ID of the Kibana Space into which the dashboards should be loaded. By default,
  # the Default Space will be used.
  # space.id:
# ============================ Elastic Cloud ============================
# These settings simplify using Filebeat with the Elastic Cloud (https://cloud.elastic.co/).
# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
# `setup.kibana.host` options.
# You can find the `cloud.id` in the Elastic Cloud web UI.
# cloud.id:
# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
# cloud.auth:
# =============================== Outputs ===============================
# Configure what output to use when sending the data collected by the beat.
# ---------------------------- Elasticsearch Output ----------------------------
- output.elasticsearch:
  # Array of hosts to connect to.
    hosts: ["https://localhost:9200", "https://1.1.1.1:9200"]
  # Protocol - either `http` (default) or `https`.
  # protocol: "https"
    username: "user"
    password: "pass"
    ssl.verification_mode: none
# ------------------------------ Logstash Output ------------------------------```
````

---

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [October 23, 2023, 4:16am UTC](https://discuss.elastic.co/t/foilebeat-iis-module-config/345325/2 "2023-10-23T04:16:58Z")

</div>

> [@dfir](#):
>
> ```auto
> - output.elasticsearch:
> # Array of hosts to connect to.
> hosts: ["https://localhost:9200", "https://1.1.1.1:9200"]
> 
> ```

I wonder if it's as simple as indentation

```auto
- output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://localhost:9200", "https://1.1.1.1:9200"]

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 23, 2023, 5:57am UTC](https://discuss.elastic.co/t/foilebeat-iis-module-config/345325/3 "2023-10-23T05:57:35Z")

</div>

Hi @dfir

I'm not sure what documentation or instructions are following but you're close but not configuring nor executing correctly.

Please follow the quick start guide and just use IIS instead of the nginx example

> **[Filebeat quick start: installation and configuration | Filebeat Reference...](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html)**

You need to clean up and follow those instructions and then edit the iis.yml as well as the filebeat.yml

Enabling the iis module  
Also a key step is running setup as shown in the quick start guide

---

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [October 23, 2023, 12:08pm UTC](https://discuss.elastic.co/t/foilebeat-iis-module-config/345325/4 "2023-10-23T12:08:13Z")

</div>

Thanks for the suggestion. I definitely have has some indenting issues. I will double check.

---

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [October 23, 2023, 12:08pm UTC](https://discuss.elastic.co/t/foilebeat-iis-module-config/345325/5 "2023-10-23T12:08:57Z")

</div>

@stephenb Thanks for the link. Ill run through the link. I am following some documentation both internally here and from the filebeat website. Ill go through it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2023, 12:09pm UTC](https://discuss.elastic.co/t/foilebeat-iis-module-config/345325/6 "2023-11-20T12:09:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.