Skip to content

Instantly share code, notes, and snippets.

@ssippe

ssippe/AWS Cloudwatch Log Insights Parse IIS.txt

Created March 29, 2022 06:40
Show Gist options
  • Save ssippe/bad88935a6821630376efba83297184f to your computer and use it in GitHub Desktop.
Save ssippe/bad88935a6821630376efba83297184f to your computer and use it in GitHub Desktop.
Download ZIP
Raw
AWS Cloudwatch Log Insights Parse IIS.txt
parse @message "* * * * * * * * * * * * * * *" as
date, time, s_ip, cs_method, cs_uri_stem, cs_uri_query, s_port, cs_username, c_ip, cs_User_Agent, cs_Referer, sc_status, sc_substatus, sc_win32_status, time_taken
| display @timestamp,cs_method, cs_uri_stem, time_taken
| filter time_taken > 1000
| sort @timestamp desc
| limit 20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment