IIS module fields

Elastic Stack Beats
1

I have enable IIS module and ingested IIS logs directly to elasticsearch. I can see the logs in kibana but i cannot see the fields available for iis module. I have the same version for plugins as kibana and elasticsearch.
Can anyone help me?
Thanks!

2

I have enable IIS module and ingested IIS logs directly to elasticsearch.

Modules uses the ingest node to extract fields from the events, normally it should be done automatically when using modules. Could you share your Filebeat config here?

3

#============================= Filebeat modules ===============================

filebeat.config.modules:

Glob pattern for configuration loading

path: ${path.config}/modules.d/*.yml

Set to true to enable config reloading

reload.enabled: false

Period on which files under path should be checked for changes

#reload.period: 10s

This is what i have in filebeat.yml regarding modules. I also modified filebeat.reference.yml and iis.yml, but both in the same way. Shoul i add iis module configuration in filebeat.yml?
Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.