# 如何处理iis日志中出现中文路径的情况

**URL:** <https://discuss.elastic.co/t/iis/140857>\
**Category:** 中文提问与讨论\
**Created:** [July 20, 2018, 8:31am UTC](https://discuss.elastic.co/t/iis/140857 "2018-07-20T08:31:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![heimao](https://avatars.discourse-cdn.com/v4/letter/h/f17d59/32.png) [@heimao](https://discuss.elastic.co/u/heimao)\
**Post date:** [July 20, 2018, 8:31am UTC](https://discuss.elastic.co/t/iis/140857/1 "2018-07-20T08:31:24Z")

</div>

我的是iis7.5版本，日志默认w3c格式。  
2018-07-11 08:27:41 1.1.1.1 HEAD /安装说明书.txt - 80 - 2.2.2.2 - 404 0 2 124  
然后grok的规则是  
%{TIMESTAMP\_ISO8601:timestamp} %{IP:sourceip} %{WORD:method} %{URIPATH:uristem} (?:-|%{NOTSPACE:uriquery}) %{POSINT:port} (?:-|%{NOTSPACE:username}) %{IP:clientip} %{NOTSPACE:useragent} %{NUMBER:status} %{NUMBER:substatus} %{NUMBER:win32status} %{NUMBER:timetaken}  
我翻阅了grok的规则，发现URIPATH的规则(?:/[A-Za-z0-9$.+!_'(){},~:;=@#%&\_-]_)+，并不能匹配中文。

---

<div class="post-metadata">

**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Post date:** [July 25, 2018, 6:52am UTC](https://discuss.elastic.co/t/iis/140857/2 "2018-07-25T06:52:52Z")

</div>

所以你传的是乱码么还是什么都没有

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2018, 6:52am UTC](https://discuss.elastic.co/t/iis/140857/3 "2018-08-22T06:52:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.