ELK分析IIS日志

配置Logstash处理IIS日志

最新推荐文章于 2025-03-23 23:30:47 发布

转载最新推荐文章于 2025-03-23 23:30:47 发布 · 543 阅读

1 ·

CC 4.0 BY-SA版权

原文链接：http://www.cnblogs.com/HQFZ/p/6249568.html

文章标签：

#大数据

本文介绍如何使用Logstash配置文件来处理IIS Web服务器的日志文件。通过特定的输入路径设置、过滤器及输出配置，可以实现对日志文件的有效解析，并将解析后的数据发送到Elasticsearch进行存储。

LogStash.conf

input {
  file {
    type => "iis_log"
    path => ["C:/inetpub/logs/LogFiles/W3SVC2/u_ex*.log"]
  }
}
filter {
  #ignore log comments
  if [message] =~ "^#" {
    drop {}
  }

  grok {
    # check that fields match your IIS log settings
    match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} (%{IPORHOST:s-ip}|-) (%{WORD:cs-method}|-) %{NOTSPACE:cs-uri-stem} %{NOTSPACE:cs-uri-query} (%{NUMBER:s-port}|-) (%{NOTSPACE:c-username}|-) (%{IPORHOST:c-ip}|-) %{NOTSPACE:cs-useragent} (%{NUMBER:sc-status}|-) (%{NUMBER:sc-win32-status}|-) (%{NUMBER:time-taken}|-)"]
  }
  #Set the Event Timesteamp from the log
	date {
		match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss" ]
		timezone => "Etc/UCT"
		}
  mutate {
			remove_field => [ "log_timestamp"]
			convert => [ "sc-bytes", "float" ]
			convert => [ "cs-bytes", "float" ]
			convert => [ "time-taken", "float" ]
		}
    
  mutate {
    remove_field => [ "log_timestamp"]
	convert => [ "sc-bytes", "float" ]
    convert => [ "cs-bytes", "float" ]
    convert => [ "time-taken", "float" ]
  }

}
output {
  stdout {codec => rubydebug }
    elasticsearch {
        hosts => ["localhost:9200"]
        index => "logstash-%{type}-%{+YYYY.MM.dd}"
		flush_size => 20000
        idle_flush_time => 10
        template_overwrite => true
    }
  redis {
    host => '127.0.0.1'
    data_type => 'list'
    key => 'logstash:redis'
  }
}

转载于:https://www.cnblogs.com/HQFZ/p/6249568.html