Thanks for the help, steffens!
I am using filebeat version 6.4.2.
IIS is version 7.
I have also been following this post Parsing problem for iis server error log using filebeat 6.3.2 which I discovered after my post (I tried searching but his didn't come up).
But he stared directly into the abys, and did not survive 
I had read elsewhere that the grok patterns for IIS Module should not be edited. I can't find the source where I read that now. Should I be working with module\iis\error\ingest.json?