Hi, What is the grok pattern for the following log, as I am new to grok patterns I would need help in making the them. date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Referer) cs-host sc-status sc-substatus sc-win32-s…

The below ingest node pipeline grok pattern worked for me for the given IIS log entries. "field": "message", "patterns": [ "%{TIMESTAMP_ISO8601:iis.access.time} (?:-|%{WORD:http.request.sitename}) (?:-|%{IPORHOST:source.computername}) (?:-|%{IPORHOST:destination.address}) (?:-|%{WORD:http.r…

Discuss the Elastic Stack

What is the grok pattern for the IIS Logs

Elastic Stack Logstash

Badger September 24, 2020, 7:18pm 2

There is an example here.

Topic		Replies	Views
_grokparsefailure for IIS logs Logstash	10	2878	July 6, 2017
Can't get IIS Log row to match Grok-pattern Logstash	5	409	February 19, 2020
Help in grok filter Logstash	2	286	January 24, 2019
Parsing iis log Logstash	4	2215	June 27, 2018
How filebeat collect iis log through grok filter? tags:_grokparsefailure Logstash	5	4384	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

What is the grok pattern for the IIS Logs

Related topics