Someone

#local transforms.conf

[iis-all]
REGEX = \s(/\S+).*?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*?(\d+)(?:\s\d+){5}$
FORMAT = url::$1 clientip::$2 statuscode::$3

[mw-iis-syslog-header-stripper]
REGEX = ^<\d+>[A-Z][a-z]+\s+\d+\s\d+:\d+:\d+\s[^\s]*\s:\s(.*)$
FORMAT = $1
DEST_KEY = _raw

#local props.conf

[iis]
KV_MODE = none
REPORT-iisfields = iis-all
TIME_PREFIX = ^[A-Z][a-z]+\s+\d+\s\d+:\d+:\d+\s[^\s]*\s
TRANSFORMS-strip-mw-iis-syslog = mw-iis-syslog-header-stripper