# Please help. I'm not getting how to input IIS logs
**URL:** https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197
**Category:** Logstash
**Created:** [July 22, 2016, 4:45pm UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197 "2016-07-22T16:45:19Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@George\_Nussbaum](https://discuss.elastic.co/u/George_Nussbaum)
#### Post date: [July 22, 2016, 4:45pm UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/1 "2016-07-22T16:45:19Z")
Hello,
I installed ELK a couple weeks ago and I'm pulling what I have left of my haIr out. I'm having trouble with getting IIS log data to show up. I have filebeat installed on the clients and am using IIS Advanced logging. I have the ELK stack on a Windows box and need the following IIS log fields to produce data:
`$date, $time, $s-ip, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $X-Forwarded-For, $csUser-Agent, $cs-Referer, $sc-status, $sc-substatus, $sc-win32-status, $time-taken`
I just can't grasp it. Can someone please help? And apologies for being an idiot ☹
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 22, 2016, 5:32pm UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/2 "2016-07-22T17:32:54Z")
Is the problem
- Filebeat isn't shipping the log file data to Logstash or
- Logstash receives the data but doesn't parse it correctly?
---
### Author:  [@George\_Nussbaum](https://discuss.elastic.co/u/George_Nussbaum)
#### Post date: [July 22, 2016, 5:58pm UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/3 "2016-07-22T17:58:32Z")
Logstash doesn't parse it correctly
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 22, 2016, 5:59pm UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/4 "2016-07-22T17:59:20Z")
What configuration do you have so far? And if you're not using the csv filter for this, why not?
---
### Author:  [@George\_Nussbaum](https://discuss.elastic.co/u/George_Nussbaum)
#### Post date: [July 22, 2016, 6:17pm UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/5 "2016-07-22T18:17:24Z")
As I mentioned, I'm not understanding what needs to be done...This is what I have:
`input {
beats {
port =\> 5044
type =\> 'iis'
}
}
# First filter
filter {
#ignore log comments
if [message] =~ "^#" {
drop {}
}
grok {
match =\> ["message", "%{TIMESTAMP\_ISO8601:log\_timestamp} %{IPV4:ServerIP} %{NOTSPACE:stem} %{DATA:query} %{NUMBER:serverPort} %{DATA:username} %{IPV4:clientIP} %{QUOTEDSTRING:ForwardedIP} %{QUOTEDSTRING:useragent} %{QUOTEDSTRING:referer} %{NUMBER:httpStatusCode} %{NUMBER:scSubstatus} %{NUMBER:scwin32status} %{NUMBER:timeTakenMS}"]
tag\_on\_failure =\> []
}
date {
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]
locale =\> "en"
}
}
# Second filter
filter {
if "\_grokparsefailure" in [tags] {
```
} else {
# on success remove the message field to save space
mutate {
remove_field => ["message", "timestamp"]
}
```
}
}
output {
elasticsearch { hosts =\> ["127.0.0.1:9200"] }
stdout { codec =\> rubydebug }
}`
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 22, 2016, 6:23pm UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/6 "2016-07-22T18:23:39Z")
Can you give an example line from your log? The fields you posted previously indicated that there are commas between the fields but that's contradicted by your grok filter.
---
### Author:  [@George\_Nussbaum](https://discuss.elastic.co/u/George_Nussbaum)
#### Post date: [July 22, 2016, 6:32pm UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/7 "2016-07-22T18:32:10Z")
Sure. Heres a line from the log:
`2016-06-28 20:30:37.377 192.168.20.21 /Ping.aspx - 443 - 192.168.20.252 "10.0.1.26" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" "https://rmsnetqa.tsd-inc.com/Default.aspx" 200 0 0 5756`
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 27, 2016, 9:00am UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/8 "2016-07-27T09:00:57Z")
Your grok filter works fine:
```nohighlight
$ cat data
2016-06-28 20:30:37.377 192.168.20.21 /Ping.aspx - 443 - 192.168.20.252 "10.0.1.26" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" "https://rmsnetqa.tsd-inc.com/Default.aspx" 200 0 0 5756
$ cat test.config
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
grok {
match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{IPV4:ServerIP} %{NOTSPACE:stem} %{DATA:query} %{NUMBER:serverPort} %{DATA:username} %{IPV4:clientIP} %{QUOTEDSTRING:ForwardedIP} %{QUOTEDSTRING:useragent} %{QUOTEDSTRING:referer} %{NUMBER:httpStatusCode} %{NUMBER:scSubstatus} %{NUMBER:scwin32status} %{NUMBER:timeTakenMS}"]
}
}
$ /opt/logstash/bin/logstash -f test.config < data
Settings: Default pipeline workers: 2
Pipeline main started
{
"message" => "2016-06-28 20:30:37.377 192.168.20.21 /Ping.aspx - 443 - 192.168.20.252 \"10.0.1.26\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36\" \"https://rmsnetqa.tsd-inc.com/Default.aspx\" 200 0 0 5756",
"@version" => "1",
"@timestamp" => "2016-07-27T08:59:13.933Z",
"host" => "hallonet",
"log_timestamp" => "2016-06-28 20:30:37.377",
"ServerIP" => "192.168.20.21",
"stem" => "/Ping.aspx",
"query" => "-",
"serverPort" => "443",
"username" => "-",
"clientIP" => "192.168.20.252",
"ForwardedIP" => "\"10.0.1.26\"",
"useragent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36\"",
"referer" => "\"https://rmsnetqa.tsd-inc.com/Default.aspx\"",
"httpStatusCode" => "200",
"scSubstatus" => "0",
"scwin32status" => "0",
"timeTakenMS" => "5756"
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}
```
---
### Author:  [@George\_Nussbaum](https://discuss.elastic.co/u/George_Nussbaum)
#### Post date: [July 27, 2016, 1:41pm UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/9 "2016-07-27T13:41:18Z")
OK. I'll research further. Thanks
---
### Author:  [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [July 27, 2016, 5:59pm UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/10 "2016-07-27T17:59:25Z")
If you don't want to mess with grok filter, I wrote a guide about how to process IIS log [http://www.secureict.info/2016/07/elastic-stack-process-iis-logs.html](http://www.secureict.info/2016/07/elastic-stack-process-iis-logs.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/please-help-im-not-getting-how-to-input-iis-logs/56197/11 "2017-07-06T04:46:14Z")