IIS Log reading to parse then Syslog

Tags:

#1 smartdave

Good afternoon. I am trying to see if NXlog can solve a use case I have with IIS.

Input file file contains:

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken 2017-11-22 11:00:17 192.168.30.60 HEAD /Autodiscover - 443 - 192.168.30.58 HttpProxy.ClientAccessServer2010Ping 401 2 5 325 166 0

What I was hoping I could do with NXlog was to read the log file then send it in syslog in key value pairs using the fields I defined (which would match what IIS gives me

I need Nxlog to send in syslog ->

<12> date="2017-11-22",time="11:00:17",s-ip="192.168.30.60",cs-method="HEAD".....

Thanks

Dave

#2 b0ti Nxlog ✓
#1 smartdave

Good afternoon. I am trying to see if NXlog can solve a use case I have with IIS.

Input file file contains:

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken 2017-11-22 11:00:17 192.168.30.60 HEAD /Autodiscover - 443 - 192.168.30.58 HttpProxy.ClientAccessServer2010Ping 401 2 5 325 166 0

What I was hoping I could do with NXlog was to read the log file then send it in syslog in key value pairs using the fields I defined (which would match what IIS gives me

I need Nxlog to send in syslog ->

<12> date="2017-11-22",time="11:00:17",s-ip="192.168.30.60",cs-method="HEAD".....

Thanks

Dave

This is doable. You can [parse IIS logs](/documentation/nxlog-user-guide#iis) with `parse_w3c()` or `parse_csv()`, then convert to KVP and finally to syslog: ``` parse_w3c(); $Message = to_kvp(); to_syslog_bsd(); ```