{
  "name": "iis",
  "title": "IIS",
  "version": "1.24.5",
  "release": "ga",
  "description": "Collect logs and metrics from Internet Information Services (IIS) servers with Elastic Agent.",
  "type": "integration",
  "download": "/epr/iis/iis-1.24.5.zip",
  "path": "/package/iis/1.24.5",
  "icons": [
    {
      "src": "/img/iis.svg",
      "path": "/package/iis/1.24.5/img/iis.svg",
      "title": "iis",
      "size": "100x100",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.13.0 || ^9.0.0"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "elastic",
    "github": "elastic/obs-infraobs-integrations"
  },
  "categories": [
    "web",
    "observability"
  ],
  "signature_path": "/epr/iis/iis-1.24.5.zip.sig",
  "format_version": "3.0.0",
  "readme": "/package/iis/1.24.5/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/kibana-iis.png",
      "path": "/package/iis/1.24.5/img/kibana-iis.png",
      "title": "kibana iis",
      "size": "1960x2820",
      "type": "image/png"
    },
    {
      "src": "/img/metricbeat-iis-application-pool-overview.png",
      "path": "/package/iis/1.24.5/img/metricbeat-iis-application-pool-overview.png",
      "title": "Metricbeat IIS Application Pool Overview",
      "size": "3785x1986",
      "type": "image/png"
    },
    {
      "src": "/img/metricbeat-iis-webserver-overview.png",
      "path": "/package/iis/1.24.5/img/metricbeat-iis-webserver-overview.png",
      "title": "Metricbeat IIS Webserver Overview",
      "size": "3137x1366",
      "type": "image/png"
    },
    {
      "src": "/img/metricbeat-iis-webserver-process.png",
      "path": "/package/iis/1.24.5/img/metricbeat-iis-webserver-process.png",
      "title": "Metricbeat IIS Webserver Process",
      "size": "3108x1629",
      "type": "image/png"
    },
    {
      "src": "/img/metricbeat-iis-website-overview.png",
      "path": "/package/iis/1.24.5/img/metricbeat-iis-website-overview.png",
      "title": "Metricbeat IIS Website Overview",
      "size": "3779x1894",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/iis/1.24.5/LICENSE.txt",
    "/package/iis/1.24.5/changelog.yml",
    "/package/iis/1.24.5/manifest.yml",
    "/package/iis/1.24.5/system-test-note.md",
    "/package/iis/1.24.5/docs/README.md",
    "/package/iis/1.24.5/img/iis.svg",
    "/package/iis/1.24.5/img/kibana-iis.png",
    "/package/iis/1.24.5/img/metricbeat-iis-application-pool-overview.png",
    "/package/iis/1.24.5/img/metricbeat-iis-webserver-overview.png",
    "/package/iis/1.24.5/img/metricbeat-iis-webserver-process.png",
    "/package/iis/1.24.5/img/metricbeat-iis-website-overview.png",
    "/package/iis/1.24.5/data_stream/access/manifest.yml",
    "/package/iis/1.24.5/data_stream/access/sample_event.json",
    "/package/iis/1.24.5/data_stream/application_pool/manifest.yml",
    "/package/iis/1.24.5/data_stream/application_pool/sample_event.json",
    "/package/iis/1.24.5/data_stream/error/manifest.yml",
    "/package/iis/1.24.5/data_stream/error/sample_event.json",
    "/package/iis/1.24.5/data_stream/webserver/manifest.yml",
    "/package/iis/1.24.5/data_stream/webserver/sample_event.json",
    "/package/iis/1.24.5/data_stream/website/manifest.yml",
    "/package/iis/1.24.5/data_stream/website/sample_event.json",
    "/package/iis/1.24.5/kibana/dashboard/iis-2c171500-858b-11ea-91bc-ab084c7ec0e7.json",
    "/package/iis/1.24.5/kibana/dashboard/iis-4278ad30-fe16-11e7-a3b0-d13028918f9f.json",
    "/package/iis/1.24.5/kibana/dashboard/iis-4b975820-85a1-11ea-91bc-ab084c7ec0e7.json",
    "/package/iis/1.24.5/kibana/dashboard/iis-b4108810-861c-11ea-91bc-ab084c7ec0e7.json",
    "/package/iis/1.24.5/kibana/dashboard/iis-ebc23240-8572-11ea-91bc-ab084c7ec0e7.json",
    "/package/iis/1.24.5/data_stream/access/fields/agent.yml",
    "/package/iis/1.24.5/data_stream/access/fields/base-fields.yml",
    "/package/iis/1.24.5/data_stream/access/fields/fields.yml",
    "/package/iis/1.24.5/data_stream/application_pool/fields/agent.yml",
    "/package/iis/1.24.5/data_stream/application_pool/fields/base-fields.yml",
    "/package/iis/1.24.5/data_stream/application_pool/fields/ecs.yml",
    "/package/iis/1.24.5/data_stream/application_pool/fields/fields.yml",
    "/package/iis/1.24.5/data_stream/error/fields/agent.yml",
    "/package/iis/1.24.5/data_stream/error/fields/base-fields.yml",
    "/package/iis/1.24.5/data_stream/error/fields/fields.yml",
    "/package/iis/1.24.5/data_stream/webserver/fields/agent.yml",
    "/package/iis/1.24.5/data_stream/webserver/fields/base-fields.yml",
    "/package/iis/1.24.5/data_stream/webserver/fields/ecs.yml",
    "/package/iis/1.24.5/data_stream/webserver/fields/fields.yml",
    "/package/iis/1.24.5/data_stream/website/fields/agent.yml",
    "/package/iis/1.24.5/data_stream/website/fields/base-fields.yml",
    "/package/iis/1.24.5/data_stream/website/fields/ecs.yml",
    "/package/iis/1.24.5/data_stream/website/fields/fields.yml",
    "/package/iis/1.24.5/data_stream/access/agent/stream/log.yml.hbs",
    "/package/iis/1.24.5/data_stream/access/elasticsearch/ingest_pipeline/default.yml",
    "/package/iis/1.24.5/data_stream/application_pool/agent/stream/stream.yml.hbs",
    "/package/iis/1.24.5/data_stream/error/agent/stream/log.yml.hbs",
    "/package/iis/1.24.5/data_stream/error/elasticsearch/ingest_pipeline/default.yml",
    "/package/iis/1.24.5/data_stream/webserver/agent/stream/stream.yml.hbs",
    "/package/iis/1.24.5/data_stream/website/agent/stream/stream.yml.hbs"
  ],
  "policy_templates": [
    {
      "name": "iis",
      "title": "IIS logs and metrics",
      "description": "Collect logs and metrics from IIS instances",
      "inputs": [
        {
          "type": "logfile",
          "vars": [
            {
              "name": "condition",
              "type": "text",
              "title": "Condition",
              "description": "Condition to filter when to collect this input. See [Dynamic Input Configuration](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "title": "Collect IIS access and error logs (input: log)",
          "description": "Collecting access and error logs from IIS instances (input: log)"
        },
        {
          "type": "iis/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "condition",
              "type": "text",
              "title": "Condition",
              "description": "Condition to filter when to collect this input. See [Dynamic Input Configuration](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "title": "Collect IIS application_pool, webserver and website metrics",
          "description": "Collecting application_pool, webserver and website metrics from IIS instances"
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "iis.access",
      "title": "IIS access logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "logfile",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "C:/inetpub/logs/LogFiles/*/*.log"
              ]
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "iis-access"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "ignore_older",
              "type": "text",
              "title": "Ignore events older than",
              "description": "If this option is specified, events that are older than the specified amount of time are ignored. Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\".",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "72h"
            }
          ],
          "template_path": "log.yml.hbs",
          "title": "IIS access logs (log)",
          "description": "Collect IIS access logs using log input",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "iis",
      "path": "access"
    },
    {
      "type": "metrics",
      "dataset": "iis.application_pool",
      "title": "IIS application_pool metrics",
      "release": "ga",
      "streams": [
        {
          "input": "iis/metrics",
          "vars": [
            {
              "name": "name",
              "type": "text",
              "title": "Application pool names",
              "multi": true,
              "required": false,
              "show_user": true
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "IIS application pool metrics",
          "description": "Collect IIS application pool metrics",
          "enabled": true,
          "ingestion_method": "Windows Performance Counters"
        }
      ],
      "package": "iis",
      "elasticsearch": {},
      "path": "application_pool"
    },
    {
      "type": "logs",
      "dataset": "iis.error",
      "title": "IIS error logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "logfile",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "C:/Windows/System32/LogFiles/HTTPERR/*.log"
              ]
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "iis-error"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "ignore_older",
              "type": "text",
              "title": "Ignore events older than",
              "description": "If this option is specified, events that are older than the specified amount of time are ignored. Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\".",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "72h"
            }
          ],
          "template_path": "log.yml.hbs",
          "title": "IIS error logs (log)",
          "description": "Collect IIS error logs using log input",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "iis",
      "path": "error"
    },
    {
      "type": "metrics",
      "dataset": "iis.webserver",
      "title": "IIS web server metrics",
      "release": "ga",
      "streams": [
        {
          "input": "iis/metrics",
          "vars": [
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "IIS web server metrics",
          "description": "Collect IIS web server metrics",
          "enabled": true,
          "ingestion_method": "Windows Performance Counters"
        }
      ],
      "package": "iis",
      "elasticsearch": {},
      "path": "webserver"
    },
    {
      "type": "metrics",
      "dataset": "iis.website",
      "title": "IIS website metrics",
      "release": "ga",
      "streams": [
        {
          "input": "iis/metrics",
          "vars": [
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "IIS website metrics",
          "description": "Collect IIS website metrics",
          "enabled": true,
          "ingestion_method": "Windows Performance Counters"
        }
      ],
      "package": "iis",
      "elasticsearch": {},
      "path": "website"
    }
  ]
}