input {
       beats{
         port => "5044"
       }
    }

    filter {

    if [type] == "iis" {
                    if [message] =~ "^#" {
                            drop {}
                    }

                    grok {
                            break_on_match => false
                             match => ["message", "%{DATESTAMP:EventTime} %{NOTSPACE:Log} %{HOSTNAME:computername} %{IP:ServerIP} %{URIPROTO:method} %{URIPATH:request} (?:%{NOTSPACE:queryparam}|-) %{NUMBER:Serverport} (?:%{WORD:username}|-) %{IP:ClienteIP} %{NOTSPACE:httpversion} %{NOTSPACE:useragent} (?:%{NOTSPACE:cookie}|-) (?:%{NOTSPACE:referer}|-) (?:%{NOTSPACE:Site}|-) %{NUMBER:status} %{NUMBER:substatus} %{NUMBER:win32status} %{NUMBER:bytesreceived} %{NUMBER:bytessent} %{NUMBER:timetaken}"
            ]
                    }
                    useragent {
                        source=> "useragent"
                        prefix=> "browser"
                }

                    geoip {
                                    source => "ClienteIP"
                                    target => "geoip"
                                    add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
                                    add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
                    }

                    mutate {
                            convert => { "timetaken" => "integer" }
                            convert => { "bytessent" => "integer" }
                            convert => { "bytesreceived" => "integer" }
                            convert => { "status" => "integer" }
                            convert => { "substatus" => "integer" }
                            convert => { "win32status" => "integer" }
                            convert => { "Serverport" => "integer" }
                            remove_field => [ "message" ]
                    }
                   date {
                            match => [ "EventTime", "yy-MM-dd HH:mm:ss" ]
                    }

     }

    if [type] == "trace" {

        xml{
            store_xml => "false"
            source => "message"
            target => "Event"
            namespaces => {
              "freb" => "http://schemas.microsoft.com/win/2006/06/iis/freb"
              "tns" => "http://schemas.microsoft.com/win/2004/08/events/event"
              "ns2" => "http://schemas.microsoft.com/win/2004/08/events/trace"
    }
        xpath => [
          "/failedRequest/@url", "url",
          "/failedRequest/@appPoolId", "appPoolId",
          "/failedRequest/@verb", "verb",
          "/failedRequest/@statusCode", "statusCode",
          "/failedRequest/tns:Event/tns:EventData/tns:Data[@Name='Headers']/text()", "Headers",
          "/failedRequest/tns:Event/tns:EventData/tns:Data[@Name='RemoteAddress']/text()","RemoteAddress",
          "/failedRequest/tns:Event/tns:EventData/tns:Data[@Name='Buffer']/text()", "Htmlerror",
          "/failedRequest/tns:Event[26]/tns:EventData//tns:Data[@Name='Buffer']/text()", "Err500",
          "/failedRequest[1]/tns:Event[26]/tns:EventData[1]/tns:Data[2]/child::text()", "erro"
        ]

        }
        # Remove the long redundant message block
        mutate
        {
            remove_field => [ "message" ]
        }

     }
    }

    output {
       elasticsearch {
          hosts => [ "IP:9200" ]
          index => "iis_logs"
        }
     }