# What is the grok pattern for the IIS Logs

**URL:** <https://discuss.elastic.co/t/what-is-the-grok-pattern-for-the-iis-logs/249492>\
**Category:** Logstash\
**Created:** [September 22, 2020, 9:47am UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-the-iis-logs/249492 "2020-09-22T09:47:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dubru](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dubru/32/45511_2.png) [@Dubru](https://discuss.elastic.co/u/Dubru)\
**Post date:** [September 22, 2020, 9:47am UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-the-iis-logs/249492/1 "2020-09-22T09:47:27Z")

</div>

Hi,

What is the grok pattern for the following log, as I am new to grok patterns I would need help in making the them.

```
date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken True-Client-IP
2020-09-21 12:05:27 test hostone <source-ipv4> GET <url> - 443 - <client-ipv4> HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/423.86+(KHTML,+like+Gecko)+Chrome/10.0.4.5+Safari/423.86 - <hostname> 200 0 0 29554 1168 9594 -
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 24, 2020, 7:18pm UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-the-iis-logs/249492/2 "2020-09-24T19:18:42Z")

</div>

There is an example [here](https://discuss.elastic.co/t/custom-iis-logs-into-logstash/238726/3).

---

<div class="post-metadata">

**Author:** ![Dubru](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dubru/32/45511_2.png) [@Dubru](https://discuss.elastic.co/u/Dubru)\
**Post date:** [September 25, 2020, 7:32am UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-the-iis-logs/249492/3 "2020-09-25T07:32:06Z")

</div>

The below ingest node pipeline grok pattern worked for me for the given IIS log entries.

```auto
  "field": "message",
  "patterns": [
    "%{TIMESTAMP_ISO8601:iis.access.time} (?:-|%{WORD:http.request.sitename}) (?:-|%{IPORHOST:source.computername}) (?:-|%{IPORHOST:destination.address}) (?:-|%{WORD:http.request.method}) (?:-|%{NOTSPACE:url.path}) (?:-|%{NOTSPACE:url.query}) (?:-|%{NUMBER:destination.port:long}) (?:-|%{NOTSPACE:user.name}) (?:-|%{IPORHOST:source.address}) (?:-|%{NOTSPACE:user_agent.original}) (?:-|%{NOTSPACE:http.request.referrer}) (?:-|%{NUMBER:http.response.status_code:long}) (?:-|%{NUMBER:iis.access.sub_status:long}) (?:-|%{NUMBER:iis.access.win32_status:long}) (?:-|%{NUMBER:temp.duration:long})",
    "%{TIMESTAMP_ISO8601:iis.access.time} (?:-|%{WORD:http.request.sitename}) (?:-|%{IPORHOST:source.computername}) (?:-|%{NOTSPACE:iis.access.site_name}) (?:-|%{WORD:http.request.method}) (?:-|%{NOTSPACE:url.path}) (?:-|%{NOTSPACE:url.query}) (?:-|%{NUMBER:destination.port:long}) (?:-|%{NOTSPACE:user.name}) (?:-|%{IPORHOST:source.address}) (?:-|%{NOTSPACE:user_agent.original}) (?:-|%{NOTSPACE:iis.access.cookie}) (?:-|%{NOTSPACE:http.request.referrer}) (?:-|%{NOTSPACE:destination.domain}) (?:-|%{NUMBER:http.response.status_code:long}) (?:-|%{NUMBER:iis.access.sub_status:long}) (?:-|%{NUMBER:iis.access.win32_status:long}) (?:-|%{NUMBER:http.response.body.bytes:long}) (?:-|%{NUMBER:http.request.body.bytes:long}) (?:-|%{NUMBER:temp.duration:long})",
    "%{TIMESTAMP_ISO8601:iis.access.time} (?:-|%{WORD:http.request.sitename}) (?:-|%{IPORHOST:source.computername}) (?:-|%{IPORHOST:destination.address}) (?:-|%{WORD:http.request.method}) (?:-|%{NOTSPACE:url.path}) (?:-|%{NOTSPACE:url.query}) (?:-|%{NUMBER:destination.port:long}) (?:-|%{NOTSPACE:user.name}) (?:-|%{IPORHOST:source.address}) (?:-|HTTP/%{NUMBER:http.version}) (?:-|%{NOTSPACE:user_agent.original}) (?:-|%{NOTSPACE:iis.access.cookie}) (?:-|%{NOTSPACE:http.request.referrer}) (?:-|%{NOTSPACE:destination.domain}) (?:-|%{NUMBER:http.response.status_code:long}) (?:-|%{NUMBER:iis.access.sub_status:long}) (?:-|%{NUMBER:iis.access.win32_status:long}) (?:-|%{NUMBER:http.response.body.bytes:long}) (?:-|%{NUMBER:http.request.body.bytes:long}) (?:-|%{NUMBER:temp.duration:long})",
    """%{TIMESTAMP_ISO8601:iis.access.time} \[%{IPORHOST:destination.address}\]\(http://%{IPORHOST:destination.address}\) (?:-|%{WORD:http.request.method}) (?:-|%{NOTSPACE:url.path}) (?:-|%{NOTSPACE:url.query}) (?:-|%{NUMBER:destination.port:long}) (?:-|%{NOTSPACE:user.name}) \[%{IPORHOST:source.address}\]\(http://%{IPORHOST:source.address}\) (?:-|%{NOTSPACE:user_agent.original}) (?:-|%{NUMBER:http.response.status_code:long}) (?:-|%{NUMBER:iis.access.sub_status:long}) (?:-|%{NUMBER:iis.access.win32_status:long}) (?:-|%{NUMBER:temp.duration:long})""",
    "%{TIMESTAMP_ISO8601:iis.access.time} (?:-|%{WORD:http.request.sitename}) (?:-|%{IPORHOST:source.computername}) (?:-|%{IPORHOST:destination.address}) (?:-|%{WORD:http.request.method}) (?:-|%{NOTSPACE:url.path}) (?:-|%{NOTSPACE:url.query}) (?:-|%{NUMBER:destination.port:long}) (?:-|%{NOTSPACE:user.name}) (?:-|%{IPORHOST:source.address}) (?:-|%{NOTSPACE:user_agent.original}) (?:-|%{NUMBER:http.response.status_code:long}) (?:-|%{NUMBER:iis.access.sub_status:long}) (?:-|%{NUMBER:iis.access.win32_status:long}) (?:-|%{NUMBER:temp.duration:long})"
  ],
  "ignore_missing": true
}

```

Note: I am not suing Logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 23, 2020, 7:32am UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-the-iis-logs/249492/4 "2020-10-23T07:32:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.