Sorry to hear you're having problems. Could you please provide the following information:
-
Are you using Filebeat "as-is" (using the Filebeat index templates, using the IIS module etc)? Or do you have something like an Ingest pipeline in between?
-
What is the Grok expression that you're using?
-
What version of Filebeat are you using?