# Parsing problem for iis server error log using filebeat 6.3.2
**URL:** https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639
**Category:** Beats
**Tags:** filebeat
**Created:** [September 14, 2018, 2:56pm UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639 "2018-09-14T14:56:54Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [September 14, 2018, 2:56pm UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639/1 "2018-09-14T14:56:54Z")
My IIS HTTPERROR log is like below
> 2018-07-11 05:02:45 10.100.4.168 51477 10.100.4.97 47001 HTTP/1.1 GET /..\pixfir~1\how\_to\_login.html 403 - Forbidden -
i am getting parse error in filebeat. How to solve it ?
Grock expression in **filebeat-6.3.2-windows-x86\_64\module\iis\error\ingest.json** is like below. I didn't change it, it's default value
```
{
"description": "Pipeline for parsing IIS error logs. Requires the geoip plugin.",
"processors": [{
"grok": {
"field": "message",
"patterns":[
"%{TIMESTAMP_ISO8601:iis.error.time} %{IPORHOST:iis.error.remote_ip} %{NUMBER:iis.error.remote_port} %{IPORHOST:iis.error.server_ip} %{IPORHOST:iis.error.server_port} (?:HTTP/%{NUMBER:iis.error.http_version}|-) (?:%{WORD:iis.error.method}|-) (?:%{URIPATHPARAM:iis.error.url}|-)(?: -)? (?:%{NUMBER:iis.error.response_code}|-) (?:%{NUMBER}|-) (?:%{NOTSPACE:iis.error.reason_phrase}|-) (?:%{NOTSPACE:iis.error.queue_name}|-)"
],
"ignore_missing": true
}
}, {
"remove":{
"field": "message"
}
}, {
"rename": {
"field": "@timestamp",
"target_field": "read_timestamp"
}
}, {
"date": {
"field": "iis.error.time",
"target_field": "@timestamp",
"formats": ["yyyy-MM-dd HH:mm:ss"]
}
}, {
"remove": {
"field": "iis.error.time"
}
}, {
"geoip": {
"field": "iis.error.remote_ip",
"target_field": "iis.error.geoip"
}
}],
"on_failure" : [{
"set" : {
"field" : "error.message",
"value" : "{{ _ingest.on_failure_message }}"
}
}]
}
```
Please help. Thanks
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [September 20, 2018, 3:04pm UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639/2 "2018-09-20T15:04:02Z")
please help
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [September 25, 2018, 5:54am UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639/3 "2018-09-25T05:54:36Z")
Can you share the error you get?
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [September 28, 2018, 1:57pm UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639/4 "2018-09-28T13:57:09Z")
it's saying provided grok expression can't parse the log i specified
"provided grok expression do not match field value"
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [October 1, 2018, 6:59am UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639/5 "2018-10-01T06:59:06Z")
It looks like `%{IPORHOST:iis.error.server_port}` should match 47001 in the above. Is that as expected?
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [October 1, 2018, 12:21pm UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639/6 "2018-10-01T12:21:28Z")
> [@varun1992](#):
>
> 10.100.4.168
yes it's expected. what about http version ? i think there is some issue
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [October 6, 2018, 7:07am UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639/7 "2018-10-06T07:07:10Z")
did you find anything?
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [October 13, 2018, 8:22am UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639/8 "2018-10-13T08:22:47Z")
Sir, i found the problem. I don't know the solution. Please help
Problem is with **"/..\pixfir~1\how\_to\_login.html"**
A section in the grok as **"(?:%{URIPATHPARAM:iis.error.url}|-)(?: -)? "** cannot parse the log fully pic as below.
If i remove this portion from both log and grok all working well . attached picture for it
Please help. Thanks
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [October 16, 2018, 10:32am UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639/9 "2018-10-16T10:32:05Z")
please help
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 13, 2018, 10:39am UTC](https://discuss.elastic.co/t/parsing-problem-for-iis-server-error-log-using-filebeat-6-3-2/148639/10 "2018-11-13T10:39:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.