# \[ SOLVED\] Remove IIS log **URL:** \ **Category:** Logstash\ **Created:** [August 17, 2016, 10:08am UTC](https://discuss.elastic.co/t/solved-remove-iis-log/58240 "2016-08-17T10:08:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Alexis.d](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@Alexis.d](https://discuss.elastic.co/u/Alexis.d)\ **Post date:** [August 17, 2016, 10:08am UTC](https://discuss.elastic.co/t/solved-remove-iis-log/58240/1 "2016-08-17T10:08:56Z")
Hey there, I need some help :). I work with ELK and Nxlog for my IIS log and it's work fine 🙂 but i want to log only errors on my web sites and remove all log with sc-status 200 sc-win32-status 0 . Here an exemple of logging: 2016-08-12 08:02:09 W3SVC1 WEB ip GET /categorie.aspx categorie=403848 80 - ip HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:47.0)+Gecko/20100101+Firefox/47.0 [http://exemple/categorie.aspx?categorie=403839](http://exemple/categorie.aspx?categorie=403839) [www.exemple.es](http://www.exemple.es) 200 0 0 26088 5092 764 Here some errors : 404 2016-08-12 08:02:23 W3SVC1 WEB-01 ip GET /graphics/zoomout.cur - 80 - ip HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+Trident/7.0;+rv:11.0)+like+Gecko [http://www.exemple.es/ficheProduit.aspx?produit=5032918](http://www.exemple.es/ficheProduit.aspx?produit=5032918) [www.exemple.es](http://www.exemple.es) 404 0 2 1427 6505 109 Status 200 but win32 stauts 64 : 2016-08-12 08:03:55 W3SVC1 WEB ip GET /TagFacebook.aspx page=/accueil.aspx 80 - ip HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:47.0)+Gecko/20100101+Firefox/47.0 [http://www.exemple.es/accueil.aspx](http://www.exemple.es/accueil.aspx) [www.exemple.es](http://www.exemple.es) 200 0 32 0 5684 31 I have simple configuration of logstash : `input { tcp { port => "5044" type => "iislog" codec => json } } filter { json { source => "message" } if "_jsonparsefailure" in [tags] { drop {} } } output { elasticsearch { hosts => "localhost:9200" manage_template => false index => "%{type}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } }` Json code in Kibana `{ "_index": "iislog-2016.08.12", "_type": "%{[@metadata][type]}", "_id": "AVZ_N_fC8UR-Fmnrfwe6", "_score": null, "_source": { "EventReceivedTime": "2016-08-12 16:49:28", "SourceModuleName": "in", "SourceModuleType": "im_file", "date": "2016-08-12", "time": "14:38:10", "s-sitename": "W3SVC1", "s-computername": "WEB", "s-ip": "ip", "cs-method": "GET", "cs-uri-stem": "/AppMobile.aspx", "cs-uri-query": "some query", "s-port": 80, "cs-username": null, "c-ip": "ip", "csUser-Agent": "HTTP/1.1", "cs-version": "Mozilla/5.0+(Linux;+Android+6.0;+ALE-L21+Build/HuaweiALE-L21)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/52.0.2743.98+Mobile+Safari/537.36", "cs-host": null, "cs-Referer": "www.exemple.es", "sc-status": 302, "sc-substatus": 0, "sc-win32-status": 0, "time-taken": 1477, "sc-bytes": 3121, "cs-bytes": 62, "SourceName": "ES", "EventTime": "2016-08-12T14:38:10Z", "@version": "1", "@timestamp": "2016-08-12T14:46:29.477Z", "host": "ip", "port": 57542, "type": "iislog" },` How i can do that if i can do that ;). Thank for your time. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 17, 2016, 10:40am UTC](https://discuss.elastic.co/t/solved-remove-iis-log/58240/2 "2016-08-17T10:40:31Z")
Use a conditional together with the drop filter. [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals) ---
**Author:** ![Alexis.d](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@Alexis.d](https://discuss.elastic.co/u/Alexis.d)\ **Post date:** [August 17, 2016, 11:12am UTC](https://discuss.elastic.co/t/solved-remove-iis-log/58240/3 "2016-08-17T11:12:59Z")
Thanks for the reply magnus, Something like this should work ? : filter { if [sc-status] == "200" and [sc-win32-status] == "0"{ drop {} } } Thank for you help 🙂 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 17, 2016, 11:34am UTC](https://discuss.elastic.co/t/solved-remove-iis-log/58240/4 "2016-08-17T11:34:26Z")
Your values are integers and not strings so drop the quotes, but otherwise is looks fine. ---
**Author:** ![Alexis.d](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@Alexis.d](https://discuss.elastic.co/u/Alexis.d)\ **Post date:** [August 17, 2016, 11:40am UTC](https://discuss.elastic.co/t/solved-remove-iis-log/58240/5 "2016-08-17T11:40:41Z")
Thanks a lot 🙂 i will test that. ---
**Author:** ![Alexis.d](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@Alexis.d](https://discuss.elastic.co/u/Alexis.d)\ **Post date:** [August 17, 2016, 12:46pm UTC](https://discuss.elastic.co/t/solved-remove-iis-log/58240/6 "2016-08-17T12:46:27Z")
It works like a charm 😃 thank magnus 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/solved-remove-iis-log/58240/7 "2017-07-06T04:43:03Z")
Closed on July 6, 2017, 4:43am UTC