I'm using LogStash to import IIS logs into ElasticSearch. It's done by pointing the LogStash to the folder with IIS logs which contains several log files each per day. Currently I don't use the LogStash forwarder (not sure if it change anything).
The problem is that the LogStash waits until the current log is flushed to disk,.which takes many hours. The command "netsh http flush logbuffer" does nothing and there only 2 things to flush logs:
- New day log, which flush previous log
- I manually go to the log folder in Windows Explorer and press F5 (refresh).
So I'm looking for better way if any.
Take a look at the Advanced Logging module available at the Official Microsoft Site for generating your logs in near-realtime. It has many more options and will allow you to configure mostly any detail of your log format.