# Search for IISLogs **URL:** \ **Category:** Beats\ **Created:** [March 11, 2016, 5:50am UTC](https://discuss.elastic.co/t/search-for-iislogs/44109 "2016-03-11T05:50:29Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [March 11, 2016, 5:50am UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/1 "2016-03-11T05:50:29Z")
How can I search for IISLogs ? What input\_type: ??? should I be using ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 11, 2016, 6:36am UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/2 "2016-03-11T06:36:17Z")
You can leave `input_type` alone. What you're probably talking about is the `document_type` option. It can have any contents but if you're using Logstash to parse the logs it needs to match your Logstash configuration (i.e. if Logstash parses logs of type "x" in a certain way you need to make sure Filebeat stamps your logs with type "x"). ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [March 11, 2016, 6:46am UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/3 "2016-03-11T06:46:39Z")
I am just using FileBeats and Elastic Search to do this. I will give a try with input\_type only. I am trying to load all my IIS Logs into ES, so that I can search for HttpStatusCode i.e. 200, 400. Below is a sample IIS Log where I got a 200 and a 400 response. I need to search for all 200 responses and 400 responses(sc-status) #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken 2016-03-11 03:43:45 W3SVC2 Server001 123.34.123.123 POST /MyService/api/click2mycall/ - 8080 - 123.23.23.36 HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/48.0.2564.116+Safari/537.36 - - Server001:8080\*\* 200\*\* 0 0 218 1076 11080 2016-03-11 03:43:59 W3SVC2 Server001 123.34.123.123 POST /MyService/api/orders/phonesearch - 8080 - 123.23.23.36 HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/48.0.2564.116+Safari/537.36 - - Server001:8080 **400** 0 0 984 791 275 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 11, 2016, 7:16am UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/4 "2016-03-11T07:16:04Z")
You should feed these logs to Logstash so that you can parse them and extract e.g. the HTTP status code. ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [March 11, 2016, 2:58pm UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/5 "2016-03-11T14:58:31Z")
Can I use FileBeat to parse them out? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 11, 2016, 3:01pm UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/6 "2016-03-11T15:01:53Z")
No, Filebeat doesn't have any parsing features. ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [March 11, 2016, 3:52pm UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/7 "2016-03-11T15:52:34Z")
If you could share a possible sample link forlogstash parsing, it would be great ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 11, 2016, 6:33pm UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/8 "2016-03-11T18:33:14Z")
Have a look at [https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html). ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [March 12, 2016, 3:39am UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/9 "2016-03-12T03:39:30Z")
Can i use logstash to pull .txt files ?? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 12, 2016, 11:38am UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/10 "2016-03-12T11:38:11Z")
If you by "pull .txt files" mean read and parse line-oriented text files with logs then yes. The documentation I linked to gives a couple of examples of how to do that. ---
**Author:** ![jkdenton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkdenton/32/28732_2.png) [@jkdenton](https://discuss.elastic.co/u/jkdenton)\ **Post date:** [March 15, 2016, 3:31pm UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/11 "2016-03-15T15:31:57Z")
send the logs via filebeat to logstash, use a filter to parse the data and then output to elasticsearch. example header: Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken logstash config: input { beats { port =\> 5044 } } filter{ if ([message] =~ /^#/) { drop { } } grok { match =\> ["message", "%{TIMESTAMP\_ISO8601:log\_timestamp} %{IPORHOST:site} %{WORD:method} %{URIPATH:page} %{NOTSPACE:querystring} %{NUMBER:port} (%{NOTSPACE:username})? %{IPORHOST:clienthost} %{NOTSPACE:useragent} %{NUMBER:scstatus:int} %{NUMBER:scsubstatus} %{NUMBER:scwin32status} %{NUMBER:timetaken}"] } } ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [March 15, 2016, 4:01pm UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/12 "2016-03-15T16:01:03Z")
Thanks. Will give a try. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/search-for-iislogs/44109/13 "2017-07-05T21:54:38Z")