Is there a way to split the line below : with '--". This is from the IIS logs of Amazom Kinesis. 200 is http status code. Sometimes it is a different status code, such as 500 or 404 etc. I noticed they always have "--" in front of it (unlike windows iis log or Apache) . So if I can split it at "--" , I can use the rex field to do the rest . Whenever I try the below , it does not work . Has anyone every had to deal iis log from aws kinesis stream?
eval temp=split(logmessage,"- -") | eval FieldB=mvindex(temp,1) .
This is the line:
"220.127.116.11 GET /somethingFinder.Services/6/healthcheck - 80 - 18.104.22.168 - - 200 0 0 2"