Grok filter for IIS no working

type on a beat input is ignored if the incoming event already has a type field.

In filebeat, document_type, which sets _type, was removed in 6.0. Use a custom field as shown here.