Skip to content

Instantly share code, notes, and snippets.

@canimus
Created November 7, 2018 19:41
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save canimus/02556a55fed5a9309234cbdddeb51fcd to your computer and use it in GitHub Desktop.
Save canimus/02556a55fed5a9309234cbdddeb51fcd to your computer and use it in GitHub Desktop.
Telegraf configuration to parse IIS log files
[global_tags]
environment = "a1"
[agent]
interval = "10s"
round_interval = true
metric_batch_size = 100
metric_buffer_limit = 300
collection_jitter = "0s"
flush_interval = "10s"
flush_jitter = "0s"
precision = ""
debug = true
quiet = false
logfile = ""
hostname = ""
omit_hostname = false
###############################################################################
# OUTPUT PLUGINS #
###############################################################################
[[outputs.influxdb]]
urls = ["http://influxdb:8086"]
database = "telegraf"
###############################################################################
# INPUT PLUGINS #
###############################################################################
[[inputs.logparser]]
files = ["/tmp/u_ex161031.log"]
from_beginning = true
tagexclude = ["path"]
[inputs.logparser.grok]
measurement = "iis_log"
patterns = ['%{TIMESTAMP_ISO8601:timestamp:ts-"2006-01-02 15:04:05"} %{IP:server:tag} %{WORD:method:tag} %{URIPATH:uristem} %{NOTSPACE:query} %{NUMBER:port:int} %{NOTSPACE:username:tag} %{IPORHOST:client} %{NOTSPACE:agent} %{NOTSPACE:referer} %{NUMBER:http_code:tag} %{NUMBER:status:int} %{NUMBER:win32:int} %{NUMBER:response_time:int}']
custom_pattern_files = []
@thedanny
Copy link

Could you provide more info on this ?

@ksulli
Copy link

ksulli commented Apr 15, 2023

I found a more in-depth discussion of creating the grok pattern at https://influxdb.narkive.com/BRellDPM/need-help-for-iis-access-log-grok-parser#post6

@thedanny
Copy link

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment