hey guys!
I have a grok filter in my Logstash server for my IIS logs... but it seams the logs are not being filter by it, and there's no errors in the logstash's logs, what would happen if the problem was in the filter itself.
follow some informations that may help:
my beats.conf:
input {
beats {
port => 5044
type => "log"
} }
filter {
if [type] == "log" {
grok {
match => [ "message" => "%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:S-SiteName} %{NOTSPACE:S-ComputerName} %{IPORHOST:S-IP} %{WORD:CS-Method} %{URIPATH:CS-URI-Stem} (?:-|\"%{URIPATH:CS-URI-Query}\") %{NUMBER:S-Port} %{NOTSPACE:CS-Username} %{IPORHOST:C-IP} %{NOTSPACE:CS-Version} %{NOTSPACE:CS-UserAgent} %{NOTSPACE:CS-Cookie} %{NOTSPACE:CS-Referer} %{NOTSPACE:CS-Host} %{NUMBER:SC-Status} %{NUMBER:SC-SubStatus} %{NUMBER:SC-Win32-Status} %{NUMBER:SC-Bytes} %{NUMBER:CS-Bytes} %{NUMBER:Time-Taken}"]
}
}
output {
elasticsearch {
hosts => "10.175.142.92:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
}
}
my filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- D:\Logfiles\*\*.log
fields_under_root: true
fields:
type: iis
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 3
output.logstash:
hosts: ["10.175.142.49:5044"]
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
logging.level: debug
and how to log is showing up in Kibana:
| @timestamp | February 15th 2019, 08:45:13.680 | |
|---|---|---|
| t @version | 1 | |
| t _id | PA-e8WgBKvRFGWguXXr9 | |
| t _index | filebeat-2019.02.15 | |
| # _score | - | |
| t _type | doc | |
| t beat.hostname | my_server | |
| t beat.name | my_server | |
| t beat.version | 6.5.4 | |
| t fileset.module | iis | |
| t fileset.name | access | |
| t host.architecture | x86_64 | |
| t host.id | e2b6035c-59e1-49c1-be70-dffd00525749 | |
| t host.name | my_server | |
| t host.os.build | 9200.22640 | |
| t host.os.family | windows | |
| t host.os.platform | windows | |
| t host.os.version | 6.2 | |
| t input.type | log | |
| t message | 2019-02-15 14:45:10 W3SVC1 my_server10.160.227.166 GET /App_Themes/Basic/CSS/JQDatePicker/jquery.datepicker.css - 80 americas\myaccount 10.175.140.244 HTTP/1.1 Mozilla/5.0+(X11;+Linux+x86_64;+Catchpoint)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/59.0.3071.115+Safari/537.36 USPLASessionCookie=uspla302c04e69e27f4483db0461fa07daf4d88;+HasAppSupportRole=true http://my_server/uspla302c04e69e27f4483db0461fa07daf4d88/Cart/ExtractQuote?QuoteId=1001695266129_1_0_Q my_server 200 0 0 1473 642 31 | |
| # offset | 734,192 | |
| t prospector.type | log | |
| t source | D:\Logfiles\W3SVC1\u_ex19021514.log | |
| t tags | beats_input_codec_plain_applied | |
| t type | log |
important information:
in the same logstash port(5044) i'm receiving winlogbeats logs too.
I would be really greatful if someone could help me out here!
