Skip to content

iis_iis10_sdh: Accept IIS 10 Log Format #3476

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jun 14, 2022

Conversation

ishleenk17
Copy link
Member

  • Enhancement

What does this PR do?

IIS Beats module doesn't support the below type of IIS 10 log format:

2018-12-31 12:02:53 10.44.0.136 GET / - 443 - 10.50.6.188 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - - 401 0 0 0

Gives the below error :

Provided Grok expressions do not match field value: [2021-06-10 23:26:57 10.44.0.136 GET / - 80 - 10.46.208.5 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - itweb.acx.co 200 0 0 23]

This PR adds support for a log format for IIS 10 logs.
A new grok pattern was added that supports parsing cookie in the IIS 10 log.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Pipeline tests have been added for the new format of logs.
Running elastic-package test pipeline should be good.

@ishleenk17 ishleenk17 requested a review from a team as a code owner June 7, 2022 11:50
@elasticmachine
Copy link

elasticmachine commented Jun 7, 2022

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-06-08T12:01:42.886+0000

  • Duration: 13 min 15 sec

Test stats 🧪

Test Results
Failed 0
Passed 84
Skipped 0
Total 84

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link

elasticmachine commented Jun 7, 2022

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (2/2) 💚
Files 100.0% (2/2) 💚 3.343
Classes 100.0% (2/2) 💚 3.343
Methods 85.714% (30/35) 👎 -3.862
Lines 91.549% (260/284) 👍 2.158
Conditionals 100.0% (0/0) 💚

@ishleenk17 ishleenk17 assigned jsoriano and ishleenk17 and unassigned jsoriano Jun 8, 2022
@ishleenk17 ishleenk17 requested review from jsoriano and mtojek June 8, 2022 09:18
Copy link
Member

@jsoriano jsoriano left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@ishleenk17 ishleenk17 merged commit 193c0b2 into elastic:main Jun 14, 2022
@ishleenk17 ishleenk17 deleted the iis_sdh_iis10 branch February 7, 2025 03:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

IIS Beats module doesn't support IIS 10 log format
5 participants