I found a couple of example configurations for IIS logging, but they both rely on NXLog and contain deprecated configuration settings:
- https://github.com/joshrobb/logstash-iis/blob/master/iis-parse.conf
- https://gist.github.com/joshrobb/4977453
This is a useful site for debugging grok expressions: