IIS Custom Fields logging in Elasticsearch with Filebeat

Elastic Stack Beats
1

I am using Filebeat to ship my IIS logs to Elasticsearch. I enables the IIS module and its successfully shipping the logs.
I have few custom fields which I am writing in IIS logs files. I am seeing the correct value of these fields in log files, but they are not visible in Elasticsearch.

Any body knows how to enable Custom Fields logging in Elasticsearch?

2

Those events are parsed in Elasticsearch ingest pipelines, you can see the supplied pipelines in Kibana tools with

GET _ingest/pipelines/filebeatiis

You will need to add your custom fields to the appropriate grok patterns and any additional processing that might be needed.

The first matching pattern is used to decode the message. I'm not an IIS SME, so I'm not sure why there are so many different supplied patterns.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.