# GROK Pattern not working with IIS Logs

**URL:** <https://discuss.elastic.co/t/grok-pattern-not-working-with-iis-logs/233851>\
**Category:** Logstash\
**Created:** [May 22, 2020, 6:56am UTC](https://discuss.elastic.co/t/grok-pattern-not-working-with-iis-logs/233851 "2020-05-22T06:56:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![muthucse](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthucse/32/45217_2.png) [@muthucse](https://discuss.elastic.co/u/muthucse)\
**Post date:** [May 22, 2020, 6:56am UTC](https://discuss.elastic.co/t/grok-pattern-not-working-with-iis-logs/233851/1 "2020-05-22T06:56:30Z")

</div>

Hi ,

Applying the below grok pattern is throwing error. How to parse the [object+object] at end of the url ?

Sample Pattern:

`%{TIMESTAMP_ISO8601:iis.access.time} %{WORD:iis.access.site_name} %{WORD:http.request.method} %{URIPATH:url.path} %{NOTSPACE:url.query} %{IPORHOST:source.address}`

Sample Log:  
`2020-05-05 14:21:06 W3S GET /api/order/process/issue/GetIssuesByORder/123/[object+Object] - 122.22.22.22`

Pattern is not matching with [object+object]. How to handle this url pattern ?

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [May 22, 2020, 12:32pm UTC](https://discuss.elastic.co/t/grok-pattern-not-working-with-iis-logs/233851/2 "2020-05-22T12:32:43Z")

</div>

> [@muthucse](#):
>
> 2020-05-05 14:21:06 W3S GET /api/order/process/issue/GetIssuesByORder/123/[object+Object] - 122.22.22.22

you’re missing - in the pattern between NOTSPACE and IPORHOST

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2020, 12:32pm UTC](https://discuss.elastic.co/t/grok-pattern-not-working-with-iis-logs/233851/3 "2020-06-19T12:32:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.