Logstash work in progress

gistfile1.txt

input {
        file {
                type => "iis"
                start_position => "beginning"
                path => "C:/IISLogs/W3SVC2/*.log"
                format => "plain"
                }
}

filter
{
       if [message] =~ "^#" {
           drop {}
       }

#                geoip {
#                        database => "/opt/logstash/vendor/geoip/GeoLiteCity.dat"
#                        source => client
#                }

        grok {
                pattern => "%{TIMESTAMP_ISO8601:log_timestamp} %{NOTSPACE:sitename} %{WORD:servername} %{NOTSPACE:site} %{NOTSPACE:method} %{NOTSPACE:path} %{NOTSPACE:querystring} %{NUMBER:port|-} %{NOTSPACE:username} %{NOTSPACE:client} %{NOTSPACE:version} %{NOTSPACE:useragent} %{NOTSPACE:cookie} %{NOTSPACE:referer} %{NOTSPACE:host} %{NUMBER:status|-} %{NUMBER:substatus|-} %{NUMBER:winstatus|-} %{NUMBER:scbytes|-} %{NUMBER:csbytes|-} %{NUMBER:timetaken|-}"
        }

         mutate {
            type => "iis"
            convert => ["timetaken","integer"]
            convert => ["csbytes","integer"]
            convert => ["scbytes","integer"]
            convert => ["status","integer"]
            convert => ["substatus","integer"]
            convert => ["winstatus","integer"]
            convert => ["port","integer"]
          }


        date {
                match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss" ]
                timezone => "Etc/UCT"
        }
}

output {
        elasticsearch {
                host => "10.0.0.31"
		protocol => http
        }
        stdout {}
}