Parse IIS W3C access logs into semantic conventions

extensions:
  file_storage:
    directory: C:\ProgramData\otelcol\storage
    create_directory: true

receivers:
  filelog:
    include: ['C:\inetpub\logs\LogFiles\W3SVC*\u_ex*.log']
    start_at: end
    storage: file_storage
    operators:
      # W3C header lines (#Software, #Version, #Date, #Fields) describe the
      # file; they are not requests.
      - type: filter
        expr: 'body matches "^#"'
      # The default W3C fields of IIS 10, as its own #Fields line lists them:
      # date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username
      # c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus
      # sc-win32-status sc-bytes cs-bytes time-taken. "-" means empty.
      - type: regex_parser
        regex: '^(?P<date>\S+) (?P<time>\S+) (?P<server_address>\S+) (?P<method>\S+) (?P<path>\S+) (?P<query>\S+) (?P<server_port>\d+) (?P<user_name>\S+) (?P<client_address>\S+) (?P<user_agent>\S+) (?P<referer>\S+) (?P<status>\d{3}) (?P<substatus>\d+) (?P<win32_status>\d+) (?P<response_size>\d+) (?P<request_size>\d+) (?P<time_taken>\d+)$'
        on_error: send
      # IIS writes these timestamps in UTC.
      - type: add
        field: attributes.timestamp
        value: EXPR(attributes.date + " " + attributes.time)
        if: 'attributes.date != nil'
      - type: time_parser
        parse_from: attributes.timestamp
        layout: '%Y-%m-%d %H:%M:%S'
        location: UTC
        if: 'attributes.timestamp != nil'

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  transform/semconv:
    error_mode: ignore
    log_statements:
      - context: log
        conditions:
          - attributes["method"] != nil
        statements:
          - set(attributes["http.request.method"], attributes["method"])
          - set(attributes["url.path"], attributes["path"])
          - set(attributes["url.query"], attributes["query"]) where attributes["query"] != "-"
          - set(attributes["server.address"], attributes["server_address"])
          - set(attributes["server.port"], Int(attributes["server_port"]))
          - set(attributes["client.address"], attributes["client_address"])
          - set(attributes["user.name"], attributes["user_name"]) where attributes["user_name"] != "-"
          # IIS writes spaces in the user agent as "+".
          - set(attributes["user_agent.original"], attributes["user_agent"]) where attributes["user_agent"] != "-"
          - replace_pattern(attributes["user_agent.original"], "\\+", " ") where attributes["user_agent.original"] != nil
          - set(attributes["http.response.status_code"], Int(attributes["status"]))
          - set(attributes["iis.substatus"], Int(attributes["substatus"]))
          - set(attributes["iis.win32_status"], Int(attributes["win32_status"]))
          - set(attributes["http.response.size"], Int(attributes["response_size"]))
          - set(attributes["http.request.size"], Int(attributes["request_size"]))
          - set(attributes["iis.time_taken_ms"], Int(attributes["time_taken"]))
          - delete_matching_keys(attributes, "^(date|time|timestamp|server_address|method|path|query|server_port|user_name|client_address|user_agent|referer|status|substatus|win32_status|response_size|request_size|time_taken)$")
  batch:
    timeout: 5s

exporters:
  otlphttp:
    endpoint: https://your-backend:4318

service:
  extensions: [file_storage]
  pipelines:
    logs:
      receivers: [filelog]
      processors: [memory_limiter, transform/semconv, batch]
      exporters: [otlphttp]