Trying to setup Filebeat to send IIS logs to logstash

Filebeat version- 7.3
Logstash version- 7.3
OS- Windows

Filebeat.yml file-

  • type: log
    enabled: true

    #Paths that should be crawled and fetched. Glob based paths.

    • c:\Program Files\filebeat-7.3.0-windows-x86_64\filebeat-7.3.0-windows-x86_64\logFiles\ESMPurchaseAPILogs\Purchase_Api_Log*

#Glob pattern for configuration loading
path: ${path.config}/modules.d/*.yml

#Set to true to enable config reloading
reload.enabled: false

#==================== Elasticsearch template setting ==========================

index.number_of_shards: 1

#The tags of the shipper are included in their own field with each
#transaction published.
tags: ["esm-purchase-api-log"]

hosts: ["localhost:5044"]


  • add_host_metadata: ~
  • add_cloud_metadata: ~

Logstash config file:
input {
output {
if "esm-purchase-api-log" in [tags] {
elasticsearch {
hosts => ["localhost:9200"]
index => "esm-purchase-api-log-%{+YYYY.MM.dd}"

But it does not create any index as specified in logstash config file. Also I do not see any data reading my application logs.

However, if I directly set output of my filebeat to elasticsearch, then it starts reading my data under filebeat-* common index. However, I want to create different index for different types of files(application log files, iis log files, etc.) I am sending through filebeat. And I want to achieve it with below kind of setup:
Filebeat-> Logstash -> ElasticSerach ->Kibana

I have also enabled logstash in filebeat using command - filebeat.exe modules enable logstash. I do not want to enable iis.yml module in filebeat. I want to specify path to pick iis log files as I have done above in code.

Any help appreciated!

This is working fine now. It was taking time to create index.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.