Logstash IIS日志采集

Logstash IIS 日志采集,跟Linux上运行差不多,都需要java运行环境,装个jdk就好了,对于IIS日志暂时未处理X-forward-for,纠结怎么弄当中,貌似要装个插件,慢慢研究。

input {
  file {
    type => "IIS Log"
    path => ["C:/inetpub/logs/LogFiles/W3SVC2/u_ex*.log"]
  }
}
filter {
  grok {

      # check that fields match your IIS log settings
      match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{IPORHOST:site} %{WORD:method} %{URIPATH:page} 

%{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clienthost} %{NOTSPACE:useragent} %{NUMBER:response} 

%{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:time_taken}"]
  }

  #Set the Event Timesteamp from the log
    date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss" ]
      timezone => "Etc/UTC"
  }    
    
  
  useragent {
    source=> "useragent"
    prefix=> "browser"
  }
    
  mutate {
    remove_field => [ "log_timestamp"]
  }

}
output {
  stdout {codec => rubydebug }
  redis {
    host => '你的ip地址'
    data_type => 'list'
    key => 'logstash:redis'
  }
}

 

 

 

 

 

补充:

已经解决 windows iis日志显示源地址插件,可以添加下面这个插件

https://devcentral.f5.com/articles/x-forwarded-for-log-filter-for-windows-servers

posted @ 2015-12-11 10:08  ca0guo  阅读(1089)  评论(1编辑  收藏  举报