Note: work in progress

I found a couple of example configurations for IIS logging, but they both rely on NXLog and contain deprecated configuration settings:

This is a useful site for debugging grok expressions: