Here's an IIS log filter example for you

[lgroschen]

vAJ,

Just curious, but does the 'tags' row have a _grokparsefailure on your logs that you have already received?

[vAJ]

Just getting back in the office from some time off. Looks like it started working late Friday, but not right away when I made the change. I'm now seeing separate IIS, Apache, Event and Syslog data.

I think we're good.

For record-keeping, here's my final filter:

Code: Select all

if [SourceModuleName] == 'iis_log1' {
    grok {
        match => ["message", "%{TIMESTAMP_ISO8601:logtime} %{IP:host_ip} %{URIPROTO:method} %{URIPATH:path} (?:-|%{NOTSPACE:uri_query}sern) %{NUMBER:port} %{NOTSPACE:username} %{IP:client_ip} %{NOTSPACE:useragent} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:timetaken}"]
    } 
    mutate {
        replace => [ 'type', 'iis_log' ]
     }
}

[lgroschen]

Excellent. Glad it's working how you want it, locking this post.

/Luke