Grok username in iis log

Elastic Stack Logstash
1

Hi,

I have an IIS log, example:
"2017-10-01 08:29:29 10.70.4.52 GET /Shared+Documents/Forms/AllItems.aspx AjaxDelta=1&isStartPlt1=1506846557836 80 0#.w|auto\user_sppano_dev 10.70.4.52 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.2;+WOW64;+Trident/6.0;+.NET4.0E;+.NET4.0C;+.NET+CLR+3.5.30729;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.30729) http://sppano/_layouts/15/start.aspx#/Shared%20Documents/Forms/AllItems.aspx 200 0 0 11585"

I tried with grok to parse this, I tried to parse the user name %{USER:user} - not getting any thing, the only way I get something is with %{NOTSPACE:username} but I get the all string 0#.w|auto\user_sppano_dev I need to get only the user name user_sppano_dev

need help with this issue

Thanks,
Lior

2

What does "0#.w|auto\" mean? Is that string different between different events? If it's always the same you could say 0#\.w\|auto\\%{NOTSPACE:user}.

3

No,
"Auto" it is just example for domain name

0#.w|domain name\usename

4

Then 0#\.w\|%{WORD}\\%{NOTSPACE:user} should work fine.

5

Hi,

I put it like this in the grok line and it is not working

match => ["message","%{TIMESTAMP_ISO8601:log_timestamp} %{IP:serverIP} %{WORD:method} %{URIPATH:uriStem} %{NOTSPACE:uriQuery} %{POSINT:port} 0#.w|%{WORD}\%{NOTSPACE:username:string} %{IP:clientIP} %{NOTSPACE:userAgent} %{URI:URL} %{NUMBER:response}"]

6

Please format the configuration as preformatted text so we can see exactly what it looks like.

7

Hi,
this is example of line from IIS log:
2017-10-01 08:29:30 10.70.4.52 GET /Lists/NewsFeed/AllItems.aspx AjaxDelta=1 80 0#.w|c-ad\sp_dev 10.70.4.52 Mozilla/4.0+(compatible;+MSIE+7.0;

this is the grok line:
grok {
match => ["message","%{TIMESTAMP_ISO8601:log_timestamp} %{IP:serverIP} %{WORD:method} %{URIPATH:uriStem} %{NOTSPACE:uriQuery} %{POSINT:port} %{NOTSPACE:username} %{IP:clientIP} %{NOTSPACE:userAgent} %{URI:URL} %{NUMBER:response}"]}

when I put 0#.w|%{WORD}\%{NOTSPACE:user} and run logstash I don't get "username" filed

8

Please format the configuration as preformatted text so we can see exactly what it looks like. Use the </> toolbar button or look up how to use Markdown formatting.

when I put 0#.w|%{WORD}%{NOTSPACE:user} and run logstash I don't get "username" filed

I assume you mean you don't get a user field since that's what the grok expression creates for you.

9

yes, I don't get the user field

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.