ELK IIS 日志–>logstash–>ElasticSearch

NXLOG 配置

#define ROOT C:\Program Files\nxlog

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules

CacheDir %ROOT%\data

Pidfile %ROOT%\data\nxlog.pid

SpoolDir %ROOT%\data

LogFile %ROOT%\data\nxlog.log

<Extension w3c>

Module xm_csv

Fields $date, $time, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $sc-status, $sc-substatus, $sc-win32-status, $time-taken

FieldTypes string, string, string, string, string, string, integer, string, string, string, integer, integer, integer, integer

Delimiter ‘ ‘

</Extension>

<Extension json>

Module xm_json

</Extension>

<Extension syslog>

Module xm_syslog

</Extension>

<Input IIS_Logs>

Module im_file

File “C:\inetpub\logs\LogFiles\W3SVC18\u_ex*.log”

SavePos TRUE

Exec if $raw_event =~ /^#/ drop();                                 \

else                                                         \

{                                                         \

w3c->parse_csv();                                         \

$EventTime = parsedate($date + “T” + $time+”Z”);         \

$SourceName = “IIS”;                                        \

}

</Input>

<Output IIS_out>

Module om_tcp

Host 127.0.0.1

Port 5545

Exec to_json();

</Output>

<Route 2>

Path IIS_Logs => IIS_out

</Route>

Logstash 配置

input {

tcp {

port=>5545

type=>”iis-input”

codec => “json”

}

}

output {

if [type]==”iis-input” {

elasticsearch {

hosts => [“localhost:9200”]

index=>”logstash-%{type}-%{+YYYY.MM.dd}”

document_type=>”%{type}”

}

}

}