# IIS Custom Fields logging in Elasticsearch with Filebeat

**URL:** <https://discuss.elastic.co/t/iis-custom-fields-logging-in-elasticsearch-with-filebeat/242525>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 24, 2020, 2:44pm UTC](https://discuss.elastic.co/t/iis-custom-fields-logging-in-elasticsearch-with-filebeat/242525 "2020-07-24T14:44:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kunjan\_Sanghavi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kunjan_sanghavi/32/48275_2.png) [@Kunjan\_Sanghavi](https://discuss.elastic.co/u/Kunjan_Sanghavi)\
**Post date:** [July 24, 2020, 2:44pm UTC](https://discuss.elastic.co/t/iis-custom-fields-logging-in-elasticsearch-with-filebeat/242525/1 "2020-07-24T14:44:21Z")

</div>

I am using Filebeat to ship my IIS logs to Elasticsearch. I enables the IIS module and its successfully shipping the logs.  
I have few [custom fields](https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/site/logfile/customfields/add) which I am writing in IIS logs files. I am seeing the correct value of these fields in log files, but they are not visible in Elasticsearch.

Any body knows how to enable Custom Fields logging in Elasticsearch?

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [July 24, 2020, 2:55pm UTC](https://discuss.elastic.co/t/iis-custom-fields-logging-in-elasticsearch-with-filebeat/242525/2 "2020-07-24T14:55:31Z")

</div>

Those events are parsed in Elasticsearch ingest pipelines, you can see the supplied pipelines in Kibana tools with

> GET \_ingest/pipelines/filebeat_iis_

You will need to add your custom fields to the appropriate grok patterns and any additional processing that might be needed.

The first matching pattern is used to decode the message. I'm not an IIS SME, so I'm not sure why there are so many different supplied patterns.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2020, 4:55pm UTC](https://discuss.elastic.co/t/iis-custom-fields-logging-in-elasticsearch-with-filebeat/242525/3 "2020-08-21T16:55:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.