# Where do I place Grok Filter for IIS on logstash
**URL:** https://discuss.elastic.co/t/where-do-i-place-grok-filter-for-iis-on-logstash/128051
**Category:** Beats
**Tags:** filebeat
**Created:** [April 14, 2018, 4:14pm UTC](https://discuss.elastic.co/t/where-do-i-place-grok-filter-for-iis-on-logstash/128051 "2018-04-14T16:14:49Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@patricktula](https://discuss.elastic.co/u/patricktula)
#### Post date: [April 14, 2018, 4:14pm UTC](https://discuss.elastic.co/t/where-do-i-place-grok-filter-for-iis-on-logstash/128051/1 "2018-04-14T16:14:49Z")
Hi,
I have a elk stack installed on windows server and I am trying to input grok filter for IIS. Where do I put that? Is it on the logstash config file? When I place it on there, I lose connection from filebeats.
input {
beats {
port =\> 5044
ssl =\> true
ssl\_certificate\_authorities =\> ["C:/temp/WinlogBeatsSSL/RootCA.crt"]
ssl\_certificate =\> "C:/temp/WinlogBeatsSSL/cert.crt"
ssl\_key =\> "C:/temp/WinlogBeatsSSL/server.key"
}
}
filter {
if [type] == "iis" {
grok {
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:log\_timestamp} %{WORD:S-SiteName} %{NOTSPACE:S-ComputerName} %{IPORHOST:S-IP} %{WORD:CS-Method} %{URIPATH:CS-URI-Stem} (?:-|"%{URIPATH:CS-URI-Query}") %{NUMBER:S-Port} %{NOTSPACE:CS-Username} %{IPORHOST:C-IP} %{NOTSPACE:CS-Version} %{NOTSPACE:CS-UserAgent} %{NOTSPACE:CS-Cookie} %{NOTSPACE:CS-Referer} %{NOTSPACE:CS-Host} %{NUMBER:SC-Status} %{NUMBER:SC-SubStatus} %{NUMBER:SC-Win32-Status} %{NUMBER:SC-Bytes} %{NUMBER:CS-Bytes} %{NUMBER:Time-Taken}"}
}
}
}
output {
elasticsearch {
hosts =\> "localhost:9200"
manage\_template =\> false
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
}
Or do I save it as a config file (.config) and place in the config folder? If so, how does logstash know to use that config file?
Thanks,
Pat
---
### Author:  [@patricktula](https://discuss.elastic.co/u/patricktula)
#### Post date: [April 14, 2018, 5:46pm UTC](https://discuss.elastic.co/t/where-do-i-place-grok-filter-for-iis-on-logstash/128051/2 "2018-04-14T17:46:48Z")
Oh on filebeat side I have this:
filebeat.prospectors:
- input\_type: log
output.logstash:
hosts: ["corputility001w:5044"]
ssl.certificate\_authorities: ["c:/programdata/winlogbeat/Rootca.crt"]
ssl.certificate: "c:/programdata/winlogbeat/cert.crt"
ssl.key: "c:/programdata/winlogbeat/detexian/server.key"
logging.level: info
logging.selectors: ["\*"]
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 12, 2018, 5:47pm UTC](https://discuss.elastic.co/t/where-do-i-place-grok-filter-for-iis-on-logstash/128051/3 "2018-05-12T17:47:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.