Logstash template for different IIS versions

[wonderlust]

After I tried everything I found the fix in this post.

Is there a way to tag for different grok matches?

Wrap all but the first grok filter in a conditional so that the subsequent ones are only tried if there hasn't been a match earlier. grok { ... } if "_grokparsefailure" in [tags] { grok { ... remove_tag => ["_grokparsefailure"] } }