# Logstash template for different IIS versions

**URL:** https://discuss.elastic.co/t/logstash-template-for-different-iis-versions/229005
**Category:** Logstash
**Created:** [April 21, 2020, 9:23am UTC](https://discuss.elastic.co/t/logstash-template-for-different-iis-versions/229005 "2020-04-21T09:23:49Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![wonderlust](https://avatars.discourse-cdn.com/v4/letter/w/f04885/32.png) [@wonderlust](https://discuss.elastic.co/u/wonderlust)
#### Post date: [April 23, 2020, 1:44pm UTC](https://discuss.elastic.co/t/logstash-template-for-different-iis-versions/229005/4 "2020-04-23T13:44:33Z")

</div>

After I tried everything I found the fix in this post.

> [@Is there a way to tag for different grok matches?](https://discuss.elastic.co/t/is-there-a-way-to-tag-for-different-grok-matches/52785/2):
>
> Wrap all but the first grok filter in a conditional so that the subsequent ones are only tried if there hasn't been a match earlier. grok { ... } if "\_grokparsefailure" in [tags] { grok { ... remove\_tag =\> ["\_grokparsefailure"] } }

---

_[View the full topic](https://discuss.elastic.co/t/logstash-template-for-different-iis-versions/229005)._