logstash config for azure iis logs

backend.conf

input {
 file {
   	type => "backend"
    path => "C:/Users/mattiasw/Desktop/logs/backend/*.txt"
    start_position => "beginning" 
	codec => multiline {
      pattern => "^\w+\s+[0-9]{4}-[0-9]{2}-[0-9]{2}\s[0-9]{2}:[0-9]{2}:[0-9]{2}.*$"
	  negate => "true"
      what => "previous"
    }
  }
}
 
filter {
 
  grok {
    # check that fields match your IIS log settings
    match => ["message", "%{WORD:tenant} {1,20}%{TIMESTAMP_ISO8601:log_timestamp} (?<thread>\[.*\]) %{WORD:level} {1,3}- (?<mainmessage>.*$)"]
  }
  
  #Set the Event Timesteamp from the log
  date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss,SSS" ]
	  timezone => "Etc/UCT"
  }

  mutate {
	remove_field => [ "remove" ]
  }
}
 
# See documentation for different protocols:
# http://logstash.net/docs/1.4.2/outputs/elasticsearch
output {
  stdout { codec => rubydebug }
  elasticsearch {
    host => "***"
    port => "9200"
    protocol => "http"
  }
}

iis.conf

input {
 file {
   	#type => "iis"
    path => "C:/Users/mattiasw/Desktop/iis/*.log"
    start_position => "beginning" 
  }
}
 
filter {
 
  #ignore log comments
  if [message] =~ "^#" {
    drop {}
  }
 
 
  grok {
    # check that fields match your IIS log settings
    match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:test} %{WORD:instance} %{IPORHOST:site} %{WORD:method} %{URIPATH:page} %{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clienthost} %{NOTSPACE:csversion} %{NOTSPACE:useragent} %{NOTSPACE:cscookie} %{NOTSPACE:csreferer} %{NOTSPACE:cshost} %{NUMBER:status} %{NUMBER:substatus} %{NUMBER:win32status} %{NUMBER:scbytes} %{NUMBER:csbytes} %{NUMBER:timetaken}"]
  }
  
  #Set the Event Timesteamp from the log
	date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss" ]
	  timezone => "Etc/UCT"
  }	
	
  
  useragent {
	source=> "useragent"
	prefix=> "browser"
  }
	
  mutate {
	remove_field => [ "log_timestamp", "test", "csversion", "cscookie", "csreferer", "win32status"]
  }
}
 
# See documentation for different protocols:
# http://logstash.net/docs/1.4.2/outputs/elasticsearch
output {
  stdout { codec => rubydebug }
  elasticsearch {
    host => "***"
    port => "9200"
    protocol => "http"
  }
}