Grok filter for IIS no working

You are trying to match (?:-|"%{URIPATH:CS-URI-Query}") to

"CS-URI-Query" => "a=4002229&p=04&b=3696&ac=&ro=EBD%20-%20Queue%20Sales%20Rep%20Brazil"

That is not a URIPATH. It is not even a URIPARAM (since that needs a leading ?}. Try replacing that whole term with %{NOTSPACE}.

Also, for some items you may want to convert to int. For example

%{NUMBER:SC-Bytes:int} %{NUMBER:CS-Bytes:int}

Personally I do not convert fields like S-Port or SC-Status to int, since I will never need to do calculations on them (would you ever care about the average port number? :slight_smile: )