GROK Pattern not working with IIS Logs

Elastic Stack Logstash
1

Hi ,

Applying the below grok pattern is throwing error. How to parse the [object+object] at end of the url ?

Sample Pattern:

%{TIMESTAMP_ISO8601:iis.access.time} %{WORD:iis.access.site_name} %{WORD:http.request.method} %{URIPATH:url.path} %{NOTSPACE:url.query} %{IPORHOST:source.address}

Sample Log:
2020-05-05 14:21:06 W3S GET /api/order/process/issue/GetIssuesByORder/123/[object+Object] - 122.22.22.22

Pattern is not matching with [object+object]. How to handle this url pattern ?

2

you’re missing - in the pattern between NOTSPACE and IPORHOST

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.