Parsing problem for iis server log using filebeat v6

[Demantel2016]

i have a problem with iis module in filebeat as link below. i disscussed it in elastic disscuss page

https://discuss.elastic.co/t/parsing-problem-for-iis-server-log-using-filebeat-6-3-2/146227

My iis log is

#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2018-08-28 18:24:25
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2018-08-28 18:24:25 [10.100.220.70](http://10.100.220.70) GET / - 80 - [10.100.118.31](http://10.100.118.31) Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.3;+WOW64;+Trident/7.0;+.NET4.0E;+.NET4.0C;+.NET+CLR+3.5.30729;+.NET+CLR[+2.0.50727](tel:+2050727);+.NET+CLR+3.0.30729) 404 4 2 792

and i setup iis module as below

- module: iis
  access:
    enabled: true
    var.paths: ["C:/inetpub/logs/LogFiles/*/*.log"]

  error:
    enabled: true
    var.paths: ["C:/Windows/System32/LogFiles/HTTPERR/*.log"]

I get error in elastic while parsing as Provided grock expression donot match the field value

We found out the problem was my log looks most similar to the IIS grok pattern here:
https://github.com/elastic/beats/blob/master/filebeat/module/iis/access/ingest/default.json#L7

but my log is missing the iis.access.referrer field.

Can you add the new grok pattern with out that field to iis module default.json file ?

Thanks

For confirmed bugs, please report:

• Version: 6 and above
• Operating System: Windows Server 2008 R2 or windows 7
• Discuss Forum URL: https://discuss.elastic.co/t/parsing-problem-for-iis-server-log-using-filebeat-6-3-2/146227
• Steps to Reproduce:
  Create iis log in windows server 2008 R2 or windows 7 and parse it using filebeat

[Demantel2016]

Anybody please help ?

[ruflin]

@Demantel2016 Any chance you could open a PR with a fix for the grok pattern and and and the example log you share above inside? This would make this quickest to fix.

[Demantel2016]

i didn't understand? what do you mean ?

[ruflin]

Sorry about the abbrevation. By PR I meant a Pull Request on Github: https://help.github.com/articles/about-pull-requests/