IIS Sourcetype

[Boell]

I have several IIS servers forwarding over logs using the universal forwarder. I modified the inputs.conf on each server creating a custom sourcetype of servername_iislogs. The logs aren't parsing and I found out if I had set the sourcetype to IIS they would be. If these logs are already indexed will I have to delete and re-index them with the sourcetype set to IIS in order for them to be parsed correctly?

[williamche · Accepted solution]

There is a work around if you choose not to re-index the log files. You can create a new eventtype that includes all the different iis sourcetypes. Then create a new iisFieldExtraction stanza in transforms.conf file that will be use in the props.conf to do search time field extractions.

Hope that makes sense. If not, here are some more details:

Create a new eventtype called "iislogs" using the following query:

sourcetype=*_iislogs OR sourcetype=iis*

"iis*" is used in case your indexer appends a -1 or -2 to your iis sourcetypes. I don't know why that's the case. It's suppose to have stopped doing that since version 4, but mine at version 4.2.4 is still doing it.

Anyway, now you have to add the following in transforms.conf file to define a generic field extraction information for your *_iislogs sourcetypes.

[delimExtractionsIIS]
FIELDS="date","time","s-sitename","s-computername","s-ip","cs-method","cs-uri-stem","cs-uri-query","s-port","cs-username","c-ip","cs-version","cs-user-agent","cs-Cookie","cs-referer","cs-host","sc-status","sc-substatus","sc-win32-status","sc-bytes","cs-bytes","time-taken"
DELIMS = " "

Now, create a [servername_iislogs] stanza for all the iislogs sourcetypes in props.conf that looks like the following:

[server1_iislogs]
REPORT-iislogs = delimExtractionsIIS

[server2_iislogs]
REPORT-iislogs = delimExtractionsIIS

If the path to the iis log files on all the servers are identical, you can also use just a single "source" stanza for all the servers. For example, if all your iis log files are stored on d:\logs\iislogs you can just use the following:

[source::...\\logs\\iislogs\\...\\ex*.log]
REPORT-iislogs = delimExtractionsIIS

From now on, all your IIS related queries must begin with eventtype=iislogs.

example: eventtype=iislogs | table s-ip, c-ip

[treinke]

OMG! That is truely amazing! Thank you for putting the work in to this.

[Boell]

This worked, Thanks!!