File Beat IIS Module not supporting few characters used in the path

[syedsfayaz]

https://discuss.elastic.co/t/filebeat-not-forwarding-my-iis-logs-to-elastic-search/170972/6

error: "Provided Grok expressions do not match field value: "

For confirmed bugs, please report:

• Version: 6.6.1
• Operating System: Windows Server 2016
• Discuss Forum URL: https://discuss.elastic.co/t/filebeat-not-forwarding-my-iis-logs-to-elastic-search/170972/6
• Steps to Reproduce: Use the default W3c Logs from IIS and send it to elastic search.

@ph

[syedsfayaz]

[kaiyan-sheng]

Hi @syedsfayaz, thanks for creating this issue. I see in the picture above, the log message that's causing the issue look like:

2018-12-31 12:52:33 10.44.0.136 GET /${#context['xwork.MethodAccessor.denyMethodExecution']=!(#_memberAccess['allowStaticMethodAccess']=true),(@java.lang.Runtime@getRuntime()).exec('ipconfig').waitFor()}.action - 443 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 404 0 2 0

Is this the actual log message? If not, can you add some examples on what the iis log look like in this ticket? That would be very helpful! Thank you!

[syedsfayaz]

Although I am not seeing the same pattern in my logs now. This is what I found in my old logs

Added a sample log

2018-12-31 12:52:33 10.00.0.000 GET / redirect:${%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23webroot%3d%23req.getSession().getServletContext().getRealPath('/'),%23resp%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse').getWriter(),%23resp.print('At%201546260753%20Nessus%20found%20the%20path%20is%20'),%23resp.println(%23webroot),%23resp.flush(),%23resp.close()} 443 - 10... Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 401 0 0 0

[kaiyan-sheng]

@syedsfayaz Perfect, thank you!