Process IIS Logs with GROK patterns and Extractor

Graylog Central (peer support)
1

I have successfully sent IIS logs to Graylog using NXlog. How can I create a pattern for the c-ip value in the message received by Graylog?

Here is my NXlog configuration:

<Extension w3c>
    Module xm_csv
    Fields $datetime, $c-ip
    FieldTypes string, string
    Delimiter ' '
    QuoteChar '"'
    EscapeControl TRUE
    UndefValue -
</Extension>
<Output out>
    Module om_udp
    Host 192.168.1.1000
    Port 13254
    Exec to_syslog_bsd();
</Output>

image
image