# Iis日志分段格式和映射

**URL:** <https://discuss.elastic.co/t/iis/92006>\
**Category:** 中文提问与讨论\
**Created:** [July 6, 2017, 3:02am UTC](https://discuss.elastic.co/t/iis/92006 "2017-07-06T03:02:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dog](https://avatars.discourse-cdn.com/v4/letter/d/13edae/32.png) [@dog](https://discuss.elastic.co/u/dog)\
**Post date:** [July 6, 2017, 3:02am UTC](https://discuss.elastic.co/t/iis/92006/1 "2017-07-06T03:02:57Z")

</div>

我需要解析IIS的日志文件，，我想它在Kibana里得日志看起来是这样的格式，我看了文档，做了一些尝试之后，现在毫无进展，有人可以帮助我吗  
我希望在Kibana显示的日志模板大致为  
"date"：2017-07-06 02:09:01  
"serverIP": 127.0.0.1  
"method": GET

---

<div class="post-metadata">

**Author:** ![medcl.net](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/medcl.net/32/4414_2.png) [@medcl.net](https://discuss.elastic.co/u/medcl.net)\
**Post date:** [July 26, 2017, 12:50am UTC](https://discuss.elastic.co/t/iis/92006/2 "2017-07-26T00:50:41Z")

</div>

你是用Logstash来做解析么？  
这里有篇参考文章：[https://blog.sstorie.com/importing-iis-logs-into-elasticsearch-with-logstash/](https://blog.sstorie.com/importing-iis-logs-into-elasticsearch-with-logstash/)

---

<div class="post-metadata">

**Author:** ![dog](https://avatars.discourse-cdn.com/v4/letter/d/13edae/32.png) [@dog](https://discuss.elastic.co/u/dog)\
**Post date:** [July 27, 2017, 1:49am UTC](https://discuss.elastic.co/t/iis/92006/3 "2017-07-27T01:49:02Z")

</div>

think you

---

<div class="post-metadata">

**Author:** ![medcl.net](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/medcl.net/32/4414_2.png) [@medcl.net](https://discuss.elastic.co/u/medcl.net)\
**Post date:** [August 1, 2017, 2:47am UTC](https://discuss.elastic.co/t/iis/92006/4 "2017-08-01T02:47:34Z")

</div>

不客气。

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2017, 2:47am UTC](https://discuss.elastic.co/t/iis/92006/5 "2017-08-29T02:47:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.