Collecting IIS Log

[BenjaminYabre]

Hi,

I have configured the filebeat to collect the IIS log,

but I don't see any dataset related to the IIS log in the dataset table and also don't know how and in which dataset to get those logs.

this the filebeat configuration

---
filebeat.modules:
- module: iis
access:
enabled: true
var.paths:
- C:/inetpub/logs/LogFiles/W3SVC*/u_ex*.log
error:
enabled: true
var.paths:
- C:/Windows/System32/LogFiles/HTTPERR/*.log
processors:
- add_fields:
fields:
vendor: microsoft
product: IIS

[jmazzeo]

Hi @BenjaminYabre,

Regarding your filebeat config, the logs should go to the dataset called "microsoft_iis_raw". The dataset format is vendor_product_raw.

If this post answers your question, please mark it as the solution.

[BenjaminYabre]

hi !

Thanks for your feedback.