# Importing IIS logs and matching it with GROK and adding additional fields
**URL:** https://discuss.elastic.co/t/importing-iis-logs-and-matching-it-with-grok-and-adding-additional-fields/229426
**Category:** Beats
**Tags:** filebeat
**Created:** [April 23, 2020, 9:39am UTC](https://discuss.elastic.co/t/importing-iis-logs-and-matching-it-with-grok-and-adding-additional-fields/229426 "2020-04-23T09:39:50Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@W.Almansoori](https://discuss.elastic.co/u/W.Almansoori)
#### Post date: [April 23, 2020, 9:39am UTC](https://discuss.elastic.co/t/importing-iis-logs-and-matching-it-with-grok-and-adding-additional-fields/229426/1 "2020-04-23T09:39:50Z")
Hello there.
I've been trying to import some logs from an IIS server. I configured the filebeat.yml, enabled inputs and set the path.
I've enabled the IIS module as well and configured the path of the access logs.
Starting filebeat does import the data but it only imports the very first line and skips the rest.
This is the filebeat.yml:
```
---
filebeat.config.modules:
path: "${path.config}/modules.d/*.yml"
reload.enabled: false
filebeat.inputs:
-
enabled: true
paths:
- "C:\\Users\\Elastic\\Documents\\*.log"
type: log
output.elasticsearch:
hosts:
- "localhost:9200"
processors:
-
add_host_metadata: ~
-
add_cloud_metadata: ~
-
add_docker_metadata: ~
-
add_kubernetes_metadata: ~
setup.kibana: ~
setup.template.settings:
index.number_of_shards: 1
```
> #Fields: date time cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
> 2019-11-18 08:48:20 GET /de adpar=12345&gclid=1234567890 443 - 149.172.138.41 HTTP/2.0 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/62.0.3202.89+Safari/537.36+OPR/49.0.2725.39 - [https://www.google.de/](https://www.google.de/) [www.site-logfile-explorer.com](http://www.site-logfile-explorer.com) 301 0 0 624 543 46
> 2018-11-18 08:48:20 GET /de/ adpar=12345&gclid=1234567890 443 - 149.172.138.41 HTTP/2.0 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/62.0.3202.89+Safari/537.36+OPR/49.0.2725.39 - [https://www.google.de/](https://www.google.de/) [www.site-logfile-explorer.com](http://www.site-logfile-explorer.com) 200 0 0 12973 544 62
Currently when I create an index with the data from the filebeat and then head to the Discover tab to view the filebeat, there is data. However the message section of that entry is just
> #Fields: date time cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
The data below that, as in the log file, isn't parsed or displayed.
Furthermore, after parsing the data I would like it to be labelled according to the GROK pattern, which is the same as the fields above and maybe try to add additional fields.
Any clue what could be wrong with the parsing process?
Best regards.
---
### Author:  [@MarianaD](https://discuss.elastic.co/u/MarianaD)
#### Post date: [April 23, 2020, 10:42am UTC](https://discuss.elastic.co/t/importing-iis-logs-and-matching-it-with-grok-and-adding-additional-fields/229426/2 "2020-04-23T10:42:27Z")
hi @W.Almansoori, can you clarify here? Are you using the IIS module (if so, can you provide us with the configuration?)
In the config above I see you are using a filebeat log input, are those logs unrelated to the iis logs?
---
### Author:  [@W.Almansoori](https://discuss.elastic.co/u/W.Almansoori)
#### Post date: [April 23, 2020, 12:48pm UTC](https://discuss.elastic.co/t/importing-iis-logs-and-matching-it-with-grok-and-adding-additional-fields/229426/3 "2020-04-23T12:48:56Z")
Hi.
Yes, I am using the IIS module. Here are is the configuration
```
- module: iis
# Access logs
access:
enabled: true
var.paths: ["C:/Users/Elastic/Documents/*.log"]
# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
#var.paths:
# Error logs
error:
enabled: true
```
In the config, filebeat.yml, the path leads to where the IIS logs are stored.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 21, 2020, 12:49pm UTC](https://discuss.elastic.co/t/importing-iis-logs-and-matching-it-with-grok-and-adding-additional-fields/229426/4 "2020-05-21T12:49:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.