# IIS module fields

**URL:** <https://discuss.elastic.co/t/iis-module-fields/163203>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 7, 2019, 12:31pm UTC](https://discuss.elastic.co/t/iis-module-fields/163203 "2019-01-07T12:31:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Costi](https://avatars.discourse-cdn.com/v4/letter/c/4491bb/32.png) [@Costi](https://discuss.elastic.co/u/Costi)\
**Post date:** [January 7, 2019, 12:31pm UTC](https://discuss.elastic.co/t/iis-module-fields/163203/1 "2019-01-07T12:31:37Z")

</div>

I have enable IIS module and ingested IIS logs directly to elasticsearch. I can see the logs in kibana but i cannot see the fields available for iis module. I have the same version for plugins as kibana and elasticsearch.  
Can anyone help me?  
Thanks!

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [January 7, 2019, 6:10pm UTC](https://discuss.elastic.co/t/iis-module-fields/163203/2 "2019-01-07T18:10:29Z")

</div>

> I have enable IIS module and ingested IIS logs directly to elasticsearch.

Modules uses the ingest node to extract fields from the events, normally it should be done automatically when using modules. Could you share your Filebeat config here?

---

<div class="post-metadata">

**Author:** ![Costi](https://avatars.discourse-cdn.com/v4/letter/c/4491bb/32.png) [@Costi](https://discuss.elastic.co/u/Costi)\
**Post date:** [January 8, 2019, 9:33am UTC](https://discuss.elastic.co/t/iis-module-fields/163203/3 "2019-01-08T09:33:13Z")

</div>

#============================= Filebeat modules ===============================

filebeat.config.modules:

# Glob pattern for configuration loading

path: ${path.config}/modules.d/\*.yml

# Set to true to enable config reloading

reload.enabled: false

# Period on which files under path should be checked for changes

#reload.period: 10s

This is what i have in filebeat.yml regarding modules. I also modified filebeat.reference.yml and iis.yml, but both in the same way. Shoul i add iis module configuration in filebeat.yml?  
Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2019, 9:33am UTC](https://discuss.elastic.co/t/iis-module-fields/163203/4 "2019-02-05T09:33:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.