# Seeing error in IIS module **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 27, 2019, 6:24pm UTC](https://discuss.elastic.co/t/seeing-error-in-iis-module/187901 "2019-06-27T18:24:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\ **Post date:** [June 27, 2019, 6:24pm UTC](https://discuss.elastic.co/t/seeing-error-in-iis-module/187901/1 "2019-06-27T18:24:57Z")
Hi @pierhugues @Kaiyan_Sheng I am using ELK 7.2. I am using iis module to ship iis access logs to es. I am seeing this error. > `error.message Provided Grok expressions do not match field value: [2019-02-09 09:40:50 10.44.0.136 OPTIONS * - 8080 - 10.50.6.180 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 400 0 2148734208 0]` > > ` message 2019-02-09 09:40:50 10.44.0.136 OPTIONS * - 8080 - 10.50.6.180 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 400 0 2148734208` Here is my log file ``` #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2019-06-27 00:26:10 10.44.3.151 GET /sanity/Insights/Insights_Level1_Sanity_Report_2019_06_15-03_39_03_10.6.1_BI_Firefox.html - 443 - 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 - 200 0 0 93 2019-06-27 00:26:10 10.44.3.151 GET /favicon.ico - 443 - 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 - 200 0 0 0 2019-06-27 00:26:15 10.44.3.151 GET / - 443 - 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 - 401 0 0 515 2019-06-27 00:26:25 10.44.3.151 GET / - 443 AVWORLD\abcd2810 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 - 200 0 0 1187 2019-06-27 00:26:25 10.44.3.151 GET /Content/css v=8QYbSmx8DXbv5uGsZSvpiAsV5ev6-C7dT0ccPMSxUCQ1 443 AVWORLD\abcd2810 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 https://reports.abc.test.com/ 200 0 0 0 2019-06-27 00:26:25 10.44.3.151 GET /bundles/jquery v=FVs3ACwOLIVInrAl5sdzR2jrCDmVOWFbZMY6g6Q0ulE1 443 - 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 https://reports.ags.esri.com/ 401 0 0 0 2019-06-27 00:26:25 10.44.3.151 GET /bundles/bootstrap v=2Fz3B0iizV2NnnamQFrx-NbYJNTFeBJ2GM05SilbtQU1 443 - 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 https://reports.ags.esri.com/ 401 0 0 0 2019-06-27 00:26:25 10.44.3.151 GET /bundles/modernizr v=wBEWDufH_8Md-Pbioxomt90vm6tJN2Pyy9u9zHtWsPo1 443 - 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 https://reports.ags.esri.com/ 401 0 0 0 2019-06-27 00:26:25 10.44.3.151 GET /bundles/bootstrap v=2Fz3B0iizV2NnnamQFrx-NbYJNTFeBJ2GM05SilbtQU1 443 AVWORLD\abcd2810 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 https://reports.ags.esri.com/ 200 0 0 15 2019-06-27 00:26:25 10.44.3.151 GET /bundles/jquery v=FVs3ACwOLIVInrAl5sdzR2jrCDmVOWFbZMY6g6Q0ulE1 443 AVWORLD\abcd2810 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 https://reports.ags.esri.com/ 200 0 0 15 2019-06-27 00:26:25 10.44.3.151 GET /bundles/modernizr v=wBEWDufH_8Md-Pbioxomt90vm6tJN2Pyy9u9zHtWsPo1 443 AVWORLD\abcd2810 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 https://reports.ags.esri.com/ 200 0 0 15 2019-06-27 00:26:25 10.44.3.151 GET /favicon.ico - 443 AVWORLD\abcd2810 10.29.78.160 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 - 200 0 0 0 ``` Surprisingly when I pointed this filebeat to send logs to my test instance which is ES 7.1 it works fine and I dont see these errors. ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [June 28, 2019, 12:07am UTC](https://discuss.elastic.co/t/seeing-error-in-iis-module/187901/2 "2019-06-28T00:07:22Z")
Hello @syedsfayaz, I tested with the logs you attached with master branch of filebeat and it works fine 😄 What version of filebeat are you using? ---
**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\ **Post date:** [June 28, 2019, 12:08am UTC](https://discuss.elastic.co/t/seeing-error-in-iis-module/187901/3 "2019-06-28T00:08:38Z")
@Kaiyan_Sheng its 7.2 . This works fine with ES 7.1 but I am seeing this error on ES 7.2 ---
**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\ **Post date:** [June 28, 2019, 3:00am UTC](https://discuss.elastic.co/t/seeing-error-in-iis-module/187901/4 "2019-06-28T03:00:33Z")
@Kaiyan_Sheng added the correct log. ``` 2018-12-31 12:02:53 10.44.0.136 GET /pbserver/..À¯..À¯..À¯..À¯..À¯../winnt/system32/cmd.exe /c+dir+c:\+/OG 8080 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 404 0 64 0 2018-12-31 12:02:53 10.44.0.136 GET /pbserver/..ÁÁ..ÁÁ..ÁÁ..ÁÁ..ÁÁ../winnt/system32/cmd.exe /c+dir+c:\+/OG 8080 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 404 0 2 46 2018-12-31 12:02:53 10.44.0.136 GET /Director - 443 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 401 0 0 0 2018-12-31 12:02:53 10.44.0.136 GET / - 443 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 401 0 0 0 2018-12-31 12:02:53 10.44.0.136 GET /pbserver/..Áœ..Áœ..Áœ..Áœ..Áœ../winnt/system32/cmd.exe /c+dir+c:\+/OG 8080 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 404 0 64 15 ``` ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [June 28, 2019, 3:49am UTC](https://discuss.elastic.co/t/seeing-error-in-iis-module/187901/5 "2019-06-28T03:49:56Z")
> [@syedsfayaz](#): > > 2018-12-31 12:02:53 10.44.0.136 GET /pbserver/..À¯..À¯..À¯..À¯..À¯../winnt/system32/cmd.exe /c+dir+c:+/OG 8080 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 404 0 64 0 2018-12-31 12:02:53 10.44.0.136 GET /pbserver/..ÁÁ..ÁÁ..ÁÁ..ÁÁ..ÁÁ../winnt/system32/cmd.exe /c+dir+c:+/OG 8080 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 404 0 2 46 2018-12-31 12:02:53 10.44.0.136 GET /Director - 443 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 401 0 0 0 2018-12-31 12:02:53 10.44.0.136 GET / - 443 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 401 0 0 0 2018-12-31 12:02:53 10.44.0.136 GET /pbserver/..Áœ..Áœ..Áœ..Áœ..Áœ../winnt/system32/cmd.exe /c+dir+c:+/OG 8080 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 404 0 64 15 These logs failed with both 7.2 Filebeat and master. Could you please create a github issue for this please? ---
**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\ **Post date:** [June 28, 2019, 3:58am UTC](https://discuss.elastic.co/t/seeing-error-in-iis-module/187901/6 "2019-06-28T03:58:51Z")
one more thing. I don't see all these fields on my prod instance(ES 7.2) where as I see this on my test instance(ES7.1). **Test\_Instance:-** ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c4d97c063f7bed93b7f94a4abea401d1eb744f8b.png) **Prod\_Instance** ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b71350e6f5ac06f0c9ef9ddf4a5daaa569b14298.png) ---
**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\ **Post date:** [June 28, 2019, 4:03am UTC](https://discuss.elastic.co/t/seeing-error-in-iis-module/187901/7 "2019-06-28T04:03:17Z")
@Kaiyan_Sheng Can you please tell me a work around for this issue. It might take some time for this to get fixed. > ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 26, 2019, 4:03am UTC](https://discuss.elastic.co/t/seeing-error-in-iis-module/187901/8 "2019-07-26T04:03:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.