Thanks, that makes more sense...
I also found out what the parse error was. Azure will sometimes place a '~1' in the site name for App Service Plans and the IPORHOST doesn't like that. Because all my dates where in the past, when I had the date section uncommitted I would only see the parse error (because the @timestamp is set to the current date/time) and so it looked like everything was failing. But I found that the rest of the logs where correct, but in the past beyond the scope of my query.
Thanks for your feedback and help.