logstash conf FOR iis

gistfile1.txt

input {
file {
type => iis
path => /Users/sic/works/logs/*.log
}
}
 
filter {
#ignore log comments
if [message] =~ ^# {
drop {}
}
 
 
grok {
match => [message, %{TIMESTAMP_ISO8601:log_timestamp} %{WORD:iisSite} %{IPORHOST:site} %{WORD:method} %{URIPATH:page} %{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clienthost} %{NOTSPACE:useragent} %{NOTSPACE:referer} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:bytes:int} %{NUMBER:timetaken:int}]
}
#Set the Event Timesteamp from the log
date {
match => [ log_timestamp, YYYY-MM-dd HH:mm:ss ]
timezone => Etc/UCT
}
ruby{ code => event[kilobytes] = event[bytes] / 1024.0 }
#https://logstash.jira.com/browse/LOGSTASH-1354
#geoip{
# source => clienthost
# add_tag => [ geoip ]
#}
useragent {
source=> useragent
prefix=> browser
}
mutate {
remove_field => [ log_timestamp]
}
}
 
output {
elasticsearch {
host => 127.0.0.1
}
}