# How to identify the IIS logs in Microsoft Exchange server?

**URL:** <https://discuss.elastic.co/t/how-to-identify-the-iis-logs-in-microsoft-exchange-server/347682>\
**Category:** Elastic Observability\
**Created:** [November 22, 2023, 3:11am UTC](https://discuss.elastic.co/t/how-to-identify-the-iis-logs-in-microsoft-exchange-server/347682 "2023-11-22T03:11:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DW0728](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dw0728/32/127893_2.png) [@DW0728](https://discuss.elastic.co/u/DW0728)\
**Post date:** [November 22, 2023, 3:11am UTC](https://discuss.elastic.co/t/how-to-identify-the-iis-logs-in-microsoft-exchange-server/347682/1 "2023-11-22T03:11:44Z")

</div>

How to identify the client IP info in IIS logs? To have this info, we would like to create a IP Map to quickly know where the mail account is logged on. But currently seems it hard to figure out the client ip info in IIS log. Does the IP info is included in the "message" field? If yes, how to extract it and use it for the IP map purpose

---

<div class="post-metadata">

**Author:** ![Muthukumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthukumar/32/106655_2.png) [@Muthukumar](https://discuss.elastic.co/u/Muthukumar)\
**Post date:** [November 28, 2023, 3:49am UTC](https://discuss.elastic.co/t/how-to-identify-the-iis-logs-in-microsoft-exchange-server/347682/2 "2023-11-28T03:49:57Z")

</div>

> [@DW0728](#):
>
> ify the client IP info in IIS logs? To have this info, we would like to create a IP Map to quickly know where the mail account is logged on. But currently seems it hard to fi

@DW0728 - The latest version of IIS integration is capable of fetching the client IP from the IIS logs if the custom logging field is already enabled to capture the IP address. I hope you are already adding the `X-Forwarded-For` field to log the IP address. Currently, the IP address is parsed and stored in the `network.forwarded_ip` field.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2023, 3:50am UTC](https://discuss.elastic.co/t/how-to-identify-the-iis-logs-in-microsoft-exchange-server/347682/3 "2023-12-26T03:50:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.