My IIS HTTPERROR log is like below 2018-07-11 05:02:45 10.100.4.168 51477 10.100.4.97 47001 HTTP/1.1 GET /..\pixfir~1\how_to_login.html 403 - Forbidden - i am getting parse error in filebeat. How to solve it ? Grock expression in filebeat-6.3.2-windows-x86_64\module\iis\error\ingest.json is lik…

Parsing problem for iis server error log using filebeat 6.3.2

ruflin (ruflin) October 1, 2018, 6:59am 5

It looks like %{IPORHOST:iis.error.server_port} should match 47001 in the above. Is that as expected?

IIS Module - not groking

Topic		Replies	Views
Iis error default pipeline -- grok pattern fails for malformed url paths Beats filebeat	3	788	September 8, 2018
Filebeat IIS Access logs not parsing but Error logs are Beats filebeat	4	324	July 15, 2020
Filebeat Grok Error - IIS Beats filebeat	4	1545	September 12, 2019
Parsing problem for iis server log using filebeat 6.3.2 Beats filebeat	8	2632	October 4, 2018
_grokparsefailure tag errors parsing IIS logs using FileBeat Logstash	3	1110	January 17, 2017