title: IIS Logs and Event Logs
body: <p>First off thank you for any advice and your time. </p>
  
  <p>I recently setup an Elk stack for the company I just started working for. (This is my first experience using Logstash and Nxlog.) What I would like to do is send both IIS logs and EventLogs from the same webserver to logstash using nxlog. </p>
  
  <p>I just don't understand how to send two types of logs from one source and have the logstash.conf filter this data correctly. </p>
  
  <p>This is my nxlog.conf</p>
  
  <pre><code>## This is a sample configuration file. See the nxlog reference manual about the
  ## configuration options. It should be installed locally and is also available
  ## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html
  
  ## Please set the ROOT to the folder your nxlog was installed into,
  ## otherwise it will not start.
  
  #define ROOT C:\Program Files\nxlog
  define ROOT C:\Program Files (x86)\nxlog
  
  Moduledir %ROOT%\modules
  CacheDir %ROOT%\data
  Pidfile %ROOT%\data\nxlog.pid
  SpoolDir %ROOT%\data
  LogFile %ROOT%\data\nxlog.log
  
  &lt;Extension json&gt;
      Module xm_json
  &lt;/Extension&gt;
  &lt;Input iis_1&gt;  
        Module    im_file
        File    "F:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log"
      ReadFromLast True
      SavePos True
      Exec    if $raw_event =~ /^#/ drop();
  &lt;/Input&gt;  
  &lt;Input iis_2&gt;  
        Module    im_file
        File    "F:\inetpub\logs\LogFiles\W3SVC2\u_ex*.log"
      ReadFromLast True
      SavePos True
      Exec    if $raw_event =~ /^#/ drop();
  &lt;/Input&gt;
  &lt;Input iis_4&gt;  
        Module    im_file
        File    "F:\inetpub\logs\LogFiles\W3SVC4\u_ex*.log"
      ReadFromLast True
      SavePos True
      Exec    if $raw_event =~ /^#/ drop();
  &lt;/Input&gt;  
  &lt;Input eventlog&gt;
          Module im_msvistalog
          Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
  &lt;/Input&gt;
  &lt;Output out_iis&gt;  
      Module  om_tcp
      Host    10.191.132.86
      Port    5555
      OutputType  LineBased
  &lt;/Output&gt;  
  &lt;Route 1&gt;  
      Path    iis_1, iis_2, iis_4, eventlog=&gt; out_iis
  &lt;/Route&gt; 
  </code></pre>
  
  <p>My Current logstash.conf</p>
  
  <pre><code>input {  
        tcp {
                type =&gt; "iis"
                port =&gt; 5555
                host =&gt; "10.191.132.86"
        }
  }
  filter {  
      if [type] == "iis" {
          grok {
              match =&gt; ["@message", "%{TIMESTAMP_ISO8601:timestamp} %{IPORHOST:hostip} %{WORD:method} %{URIPATH:page} %{NOTSPACE:query} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clientip} %{NOTSPACE:useragent} %{NOTSPACE:referrer} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:timetaken}"]
          }
      }
  }
  output {  
      elasticsearch {
      protocol =&gt; "http"
          host =&gt; "10.191.132.86"
          port =&gt; "9200"
      }
  }
  </code></pre>
  
  <p>It looks like you can filter different data by setting the type and doing if type else this type. But if they are coming from the same source how do I specify different types? </p>
  
  <p>:) Thanks!</p>