# Parsing IIS log Issue

**URL:** <https://discuss.elastic.co/t/parsing-iis-log-issue/84383>\
**Category:** Logstash\
**Created:** [May 3, 2017, 9:33am UTC](https://discuss.elastic.co/t/parsing-iis-log-issue/84383 "2017-05-03T09:33:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_TRAN](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@Michael\_TRAN](https://discuss.elastic.co/u/Michael_TRAN)\
**Post date:** [May 3, 2017, 9:33am UTC](https://discuss.elastic.co/t/parsing-iis-log-issue/84383/1 "2017-05-03T09:33:44Z")

</div>

Hello,

I try to parse my IIS log but the problems is that my kibana doesn't recognize the index pattern (logstash\_iis-\*).

Here the IIS logstash configuration file (/etc/logstash/conf.d/logstash\_iis.conf)

```
 input {
	file {
		type => "IISLog"
		path => "/var/log/ELS/portail1/*.log"
		path => "/var/log/ELS/portail2/*.log"
		path => "/var/log/ELS/portail3/*.log"
		path => "/var/log/ELS/portail4/*.log"
		start_position => "beginning"
	}
}

filter {
	grok {
        match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{IPORHOST:site} %{WORD:method} %{URIPATH:page} %{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clienthost} %{NOTSPACE:useragent} (%{URI:referer})? %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:time_taken}"]
	}
  
	date {
		match => ["log_timestamp", "YYYY-MM-dd HH:mm:ss"]
		timezone => "Etc/UCT"
	}
	
	useragent {
		source=> "useragent"
		prefix=> "browser_"
	}
	
	mutate {
		remove_field => ["log_timestamp"]
	}
}

output {
    stdout { codec => rubydebug }
	elasticsearch { 
	hosts => ["MyELIP:9200"]
	index => "logstash_iis-%{+YYYY.MM.dd}"	
	}
}

```

Log file for Logstash (/var/log/logstash)

 ![](https://us1.discourse-cdn.com/elastic/original/3X/5/9/594de06a7d045a132d0ae6718f6e1c09b7ab3385.jpg)

I restarted all the ELK service but I still have this issue  
Do you have any idea on this ? Thanks

Michael

---

<div class="post-metadata">

**Author:** ![Michael\_TRAN](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@Michael\_TRAN](https://discuss.elastic.co/u/Michael_TRAN)\
**Post date:** [May 3, 2017, 1:28pm UTC](https://discuss.elastic.co/t/parsing-iis-log-issue/84383/2 "2017-05-03T13:28:21Z")

</div>

I try with another ELK server and it's working so for me the logstash configuration file is good. I don't know why, on this server it doesn't working....

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 31, 2017, 1:30pm UTC](https://discuss.elastic.co/t/parsing-iis-log-issue/84383/3 "2017-05-31T13:30:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.