When you select Parse with W3C as the Parse Method, enter the W3C field names in the Fields box as a comma-separated list with no spaces. The list is split only at commas, so a space before or after a field name becomes part of that name and the rule you write for it will not match. A sample field list and log line are given below.
Fields:
datetime,c-ip,cs-username,s-ip,s-port,cs-method,cs-uri-stem,cs-uri-query,sc-status,sc-bytes,cs-bytes,time-taken,cs(User-Agent),cs(Referer)
Log Sample:
2024-10-08T16:44:29 192.168.1.1 - 10.0.0.1 80 GET /index.html - 200 1024 512 123 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) http://example.com
The values in the log line are matched to the names in Fields by position, so the log line must contain exactly one value per field. When the delimiter is whitespace, a value that contains spaces is split into several values unless it is enclosed in double quotes ("...") or square brackets ([...]). This is why the User-Agent value in the sample uses + instead of spaces, as W3C logs written by IIS do. Values enclosed in parentheses only are not kept together.
In the Delimiter list, select the character that separates the values in your log. The list contains punctuation characters (- ; : \ , . / ? @ # $ % ^ & * _ ~) and whitespace. The sample above uses whitespace.
Then add a rule under Rules for each field you want to map. In each rule, type a name from the Fields list into the Match field box, select the Logsign column in the Field list, and click Add. For time columns, also select the time format.
The sample log does not contain a user name (cs-username is "-"), so Source.UserName stays empty for this line. Add a rule for this field anyway: other log lines from the same source may contain a user name, and it will not be parsed if there is no rule for it. Add a rule for each name under Fields.
Under Mapping, you can select Static to assign a fixed event mapping to the logs. At this stage, use the Log Message List as a reference.
If you want to map events with a file instead, select File. The steps for this method are described in Parse with JSON.