# How to split message field for IIS log.. In debugger it is splitting but when i run config file it is not splitting, so not able to use in Kibana Grpahs

**URL:** <https://discuss.elastic.co/t/how-to-split-message-field-for-iis-log-in-debugger-it-is-splitting-but-when-i-run-config-file-it-is-not-splitting-so-not-able-to-use-in-kibana-grpahs/164914>\
**Category:** Logstash\
**Created:** [January 19, 2019, 9:35pm UTC](https://discuss.elastic.co/t/how-to-split-message-field-for-iis-log-in-debugger-it-is-splitting-but-when-i-run-config-file-it-is-not-splitting-so-not-able-to-use-in-kibana-grpahs/164914 "2019-01-19T21:35:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rahul07](https://avatars.discourse-cdn.com/v4/letter/r/9fc29f/32.png) [@Rahul07](https://discuss.elastic.co/u/Rahul07)\
**Post date:** [January 19, 2019, 9:35pm UTC](https://discuss.elastic.co/t/how-to-split-message-field-for-iis-log-in-debugger-it-is-splitting-but-when-i-run-config-file-it-is-not-splitting-so-not-able-to-use-in-kibana-grpahs/164914/1 "2019-01-19T21:35:47Z")

</div>

Sample logs  
\<

#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken  
2017-04-18 00:00:00 AAAAAA COMPUTER10001 10.10.25.10 POST /AA/AA - 80 - 10.20.30.251 HTTP/1.1 Mozilla/5.0+(iPad;+CPU+OS+10\_3\_1+like+Mac+OS+X)+AppleWebKit/603.1.30+(KHTML,+like+Gecko)+Version/10.0+Mobile/14E304+Safari/602.1 [https://aa.aa.com/AA/Term.aspx](https://aa.aa.com/AA/Term.aspx) [aa.aa.com](http://aa.aa.com) 200 0 0 372 2454 15

/\>  
\<

```
input{	
file
{	path => "/tmp/u_ex170418_new_1.log"
	start_position =>"beginning"
	sincedb_path => "NUL"
}
}
filter{
if[prospector][type]=="iis"
{	grok{
	match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{NOTSPACE:s-sitename} %{NOTSPACE:s-computername} %{NOTSPACE:s-ip} %{WORD:cs-method} %{URIPATH:cs-uri-stem} %{NOTSPACE:cs-uri-query} %{NUMBER:s-port} %{NOTSPACE:cs-username} %{IPORHOST:c-ip} %{NOTSPACE:cs-vertion} %{NOTSPACE:cs-useragent} %{NOTSPACE:cs-Referer} %{NOTSPACE:cs-host} %{NUMBER:sc-status:int} %{NUMBER:sc-substatus:int} %{NUMBER:sc-win32-status:int} %{NUMBER:sc-bytes:int} %{NUMBER:cs-bytes:int} %{NUMBER:time-taken:int}"]
	add_tag =>"success"
    remove_field => ["message"]		
}
if "success" not in [tags] {
							drop { }
}date {
		match => ["log_timestamp", "YYYY-MM-dd HH:mm:ss"]
		timezone => "Etc/UTC"
	}
}
split {
		field => "[message]"
    #	add_field =>{
    #	"s-computername" => "%{[s-computername]}"
}
mutate {
	remove_field => ["log_timestamp"]				
	#remove_field => ["message"]				
		}
  }output
  {	elasticsearch
{	hosts => ["localhost:9200"]
	index => ["aa_iis_1"]
	document_type => "iis"
}stdout{} }

```

/\>

 ![Kibana_Debugger](https://us1.discourse-cdn.com/elastic/original/3X/8/0/80b81a681a1179b0cdfe1eb23066b2612cdc8a6d.jpeg) ![Logstash_conf_Result](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5de403d59b618ef19ce742e25117c6967f8571b8.jpeg)

---

<div class="post-metadata">

**Author:** ![Rahul07](https://avatars.discourse-cdn.com/v4/letter/r/9fc29f/32.png) [@Rahul07](https://discuss.elastic.co/u/Rahul07)\
**Post date:** [January 29, 2019, 6:16am UTC](https://discuss.elastic.co/t/how-to-split-message-field-for-iis-log-in-debugger-it-is-splitting-but-when-i-run-config-file-it-is-not-splitting-so-not-able-to-use-in-kibana-grpahs/164914/2 "2019-01-29T06:16:47Z")

</div>

I Have got the solution. commented type declaration and it works.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2019, 6:16am UTC](https://discuss.elastic.co/t/how-to-split-message-field-for-iis-log-in-debugger-it-is-splitting-but-when-i-run-config-file-it-is-not-splitting-so-not-able-to-use-in-kibana-grpahs/164914/3 "2019-02-26T06:16:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.