LogstashIIS日志采集

input {
  file {
    type => "IIS Log"
    path => ["C:/inetpub/logs/LogFiles/W3SVC2/u_ex*.log"]
  }
}
filter {
  grok {

      # check that fields match your IIS log settings
      match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{IPORHOST:site} %{WORD:method} %{URIPATH:page} 

%{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clienthost} %{NOTSPACE:useragent} %{NUMBER:response} 

%{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:time_taken}"]
  }

  #Set the Event Timesteamp from the log
    date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss" ]
      timezone => "Etc/UTC"
  }    
    
  
  useragent {
    source=> "useragent"
    prefix=> "browser"
  }
    
  mutate {
    remove_field => [ "log_timestamp"]
  }

}
output {
  stdout {codec => rubydebug }
  redis {
    host => '你的ip地址'
    data_type => 'list'
    key => 'logstash:redis'
  }
}