Thank you jan and @benvanstaveren for your replies. I am not real good at the grok patterns and pipeline processing, but will give it a try. Below is an example message coming from IIS. If either of you know the quick fix to this, it would be appreciated.
The fields are:
date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
Some example data is:
2018-12-10 19:37:12 10.6.64.78 GET /dd - 443 DOMAIN\username 10.86.33.74 Mozilla/5.0+(Windows+NT+10.0;+WOW64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/71.0.3578.80+Safari/537.36 - 404 0 2 0
Thank you again.