Hello, Guys
I'am trying couple of days to setup logstash 6.3.0 on Windows Server 2012 r2.I want to parse IIS logs version on IIS is (8.5.9600) to ElasticSearch.Here is my logstash config --->
input {
file {
type => "IISLog"
path => "C:/inetpub/logs/LogFiles/W3SVC*/*.log"
start_position => "beginning"
}
}
filter {
if [message] =~ "^#" {
drop {}
}
grok {
match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{IPORHOST:site} %{WORD:method} %{URIPATH:page} %{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clienthost} %{NOTSPACE:useragent} (%{URI:referer})? %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:time_taken}"]
}
date {
match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss" ]
timezone => "Etc/UCT"
}
useragent {
source=> "useragent"
prefix=> "browser_"
}
mutate {
remove_field => [ "log_timestamp"]
}
}
output {
stdout { codec => rubydebug }
elasticsearch { hosts => ["10.8.238.11:9200"] }
}
But for some reason _grokparsefailure
"type" => "IISLog",
"@timestamp" => 2018-06-28T06:26:37.447Z,
"tags" => [
[0] "_grokparsefailure"
],
"host" => "WIN-Example",
"@version" => "1",
"message" => "2018-06-28 05:22:23 W3SVC7 WIN-Example 1.1.1.1 GET
/api/sportmatch/Get sportID=2357 80 - 192.168.0.1 Mozilla/5.0+(Windows+NT+6.
1;+WOW64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/64.0.3282.186+YaBrowser/
18.3.1.1232+Yowser/2.5+Safari/537.36 https://example.net/sport
200 0 0 2759\r",
"path" => "C:/inetpub/logs/LogFiles/W3SVC7/u_ex180628.log"
}
{
Elasticsearch version is 6.3.0
Output from Elastich search is
type": "query_shard_exception",
"reason": "Failed to parse query [host:()]",
"index_uuid": "XCV-7yPnTdSpJXY-xD5sqA",
"index": "logstash-2018.06.28"
Please help where am i wrong.Thanks