# My IIS logs were sent by filebeat and Now I want to pras them with Logstash **URL:** \ **Category:** Logstash\ **Tags:** docker\ **Created:** [March 30, 2024, 9:34am UTC](https://discuss.elastic.co/t/my-iis-logs-were-sent-by-filebeat-and-now-i-want-to-pras-them-with-logstash/356484 "2024-03-30T09:34:17Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Omid\_Mosayebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid_mosayebi/32/133125_2.png) [@Omid\_Mosayebi](https://discuss.elastic.co/u/Omid_Mosayebi)\ **Post date:** [March 30, 2024, 9:34am UTC](https://discuss.elastic.co/t/my-iis-logs-were-sent-by-filebeat-and-now-i-want-to-pras-them-with-logstash/356484/1 "2024-03-30T09:34:17Z")
I cannot separate my IIS response code in Logstash ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 30, 2024, 4:01pm UTC](https://discuss.elastic.co/t/my-iis-logs-were-sent-by-filebeat-and-now-i-want-to-pras-them-with-logstash/356484/2 "2024-03-30T16:01:40Z")
Hi @Omid_Mosayebi Welcome to the community. You are going to need to provide much more detail if you want help What Version are you on? Are you sure you need logstash? Did you look at the Filebeat IIS Module? Perhaps that will do it all for you. > **[IIS module | Filebeat Reference \[8.13\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-iis.html)** Share your filebeat and logstash config files Share Sample IIS log lines ---
**Author:** ![Omid\_Mosayebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid_mosayebi/32/133125_2.png) [@Omid\_Mosayebi](https://discuss.elastic.co/u/Omid_Mosayebi)\ **Post date:** [April 2, 2024, 4:51am UTC](https://discuss.elastic.co/t/my-iis-logs-were-sent-by-filebeat-and-now-i-want-to-pras-them-with-logstash/356484/3 "2024-04-02T04:51:54Z")
I want to say thank for your answering. it's my Logstash.conf file. ```auto input { beats { port => 5400 } } filter { #-------------------------------------NGINX----------------------------------------- if [log][file][path] =~ "nginx/access.log" { grok { match => { "message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response:int} %{NUMBER:bytes:int}(?: \"%{DATA:referrer}\" \"%{DATA:agent}\")?' } } mutate { add_field => { "[@metadata][index]" => "filebeat-response-%{+YYYY.MM.dd}" } } } #----------------------------------IIS----------------------------------------------- if [log][file][path] =~ "W3SVC1*" { grok { match => { "message" => "%{TIMESTAMP_ISO8601:log_timestamp} %{TIMESTAMP_ISO8601:log_time} %{WORD:S-SiteName} %{NOTSPACE:S-ComputerName} %{IPORHOST:S-IP} %{WORD:CS-Method} %{URIPATH:CS-URI-Stem} %{URIPATH:CS-URI-Query} %{NUMBER:S-Port} %{NOTSPACE:CS-Username} %{WORD:c-ip} %{NOTSPACE:CS-Version} %{NOTSPACE:CS-UserAgent} %{NOTSPACE:CS-Cookie} %{NOTSPACE:CS-Referer} %{NOTSPACE:CS-Host} %{NUMBER:SC-Status} %{NUMBER:SC-SubStatus} %{NUMBER:SC-Win32-Status} %{NUMBER:SC-Bytes} %{NUMBER:CS-Bytes} %{NUMBER:Time-Taken}"} } mutate {add_field => { "[@metadata][index]" => "filebeat-hresponse-%{+YYYY.MM.dd}" } } } if [log][file][path] =~ "HTTPERR*" { grok { } mutate {add_field => { "[@metadata][index]" => "filebeat-erriisesponse-%{+YYYY.MM.dd}" } } } #------------------------Hanie-------------------------------------- #------------------------------------END--------------------------------------------- } ``` ========================== I installed Filebeat on my windows for sending my IIS log into Logstash with those configs ```auto # ============================== Filebeat inputs =============================== filebeat.inputs: # Each - is an input. Most options can be set at the input level, so # you can use different inputs for various configurations. # Below are the input-specific configurations. # filestream is an input for collecting log messages from files. - type: log document_type: iis # Unique ID among all inputs, an ID is required. id: my-filestream-id # Change to true to enable this input configuration. enabled: true # Paths that should be crawled and fetched. Glob based paths. paths: #- /var/log/*.log #- c:\programdata\elasticsearch\logs\* - c:\inetpub\logs\LogFiles\W3SVC1\* # ------------------------------ Logstash Output ------------------------------- output.logstash: # The Logstash hosts hosts: ["127.0.0.1:5400"] # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"] # Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #ssl.key: "/etc/pki/client/cert.key" ``` and finally my last picture is on Kibana ![elastic1](https://us1.discourse-cdn.com/elastic/original/3X/7/6/767ddab711344d8ea5fe1a5bb20bf0f34878e226.jpeg) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [April 2, 2024, 4:58am UTC](https://discuss.elastic.co/t/my-iis-logs-were-sent-by-filebeat-and-now-i-want-to-pras-them-with-logstash/356484/4 "2024-04-02T04:58:09Z")
Hi @Omid_Mosayebi Please format your code going forward... I did it for you ... highlight the text and press the `` buttom So, if I were you, I would just try the filebeat IIS module Direct to Elasticsearch first, following the quickstart steps... you are trying to parse manually in logsash when this is probably already done for you. Follow this, but just use the IIS module and the Windows syntax. > **[Filebeat quick start: installation and configuration | Filebeat Reference...](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html)** Why do you want to use logstash? if you do not need to... If you still want to parse in logstash (which mean you need to setup up a mapping to) you will need to provide text version samples of you logs not screen shots. ---
**Author:** ![Omid\_Mosayebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid_mosayebi/32/133125_2.png) [@Omid\_Mosayebi](https://discuss.elastic.co/u/Omid_Mosayebi)\ **Post date:** [April 2, 2024, 5:08am UTC](https://discuss.elastic.co/t/my-iis-logs-were-sent-by-filebeat-and-now-i-want-to-pras-them-with-logstash/356484/5 "2024-04-02T05:08:42Z")
Hi @stephenb I will try to use Elasticsearch. ---
**Author:** ![Omid\_Mosayebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid_mosayebi/32/133125_2.png) [@Omid\_Mosayebi](https://discuss.elastic.co/u/Omid_Mosayebi)\ **Post date:** [April 2, 2024, 7:17am UTC](https://discuss.elastic.co/t/my-iis-logs-were-sent-by-filebeat-and-now-i-want-to-pras-them-with-logstash/356484/6 "2024-04-02T07:17:53Z")
`2024-04-02 07:04:02 W3SVC1 EVTSP-MYVIIS-02 172.168.192.15 POST /api/v1/InVoiceStuffsFav/GetGroupStuffList 80 172.168.192.16 HTTP/1.0 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:124.0)+Gecko/20100101+Firefox/124.0 https://my.evptsp.com/productList my.evptsp.com 200 0 0 184 708 35` Finally, I sent my IIS log by this pattern into Elasticsearch. I noticed that I had to test my pattern in grok debugger that is located in Kibana(Management\>Dev Tools\>Grok Debugger). `%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:S-SiteName} %{NOTSPACE:S-ComputerName} %{IPORHOST:S-IP} %{WORD:CS-Method} %{URIPATH:CS-URI-Stem} %{NUMBER:S-Port} %{IPORHOST:c-ip} %{NOTSPACE:CS-Version} %{NOTSPACE:CS-UserAgent} %{NOTSPACE:CS-Referer} %{NOTSPACE:CS-Host} %{NUMBER:SC-Status} %{NUMBER:SC-SubStatus} %{NUMBER:SC-Win32-Status} %{NUMBER:SC-Bytes} %{NUMBER:CS-Bytes} %{NUMBER:Time-Taken}` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 30, 2024, 7:18am UTC](https://discuss.elastic.co/t/my-iis-logs-were-sent-by-filebeat-and-now-i-want-to-pras-them-with-logstash/356484/7 "2024-04-30T07:18:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.