This is absolutely ridiculous the X-Forwarded-For field is not supported in IIS. I need to use grok patterns in Logstash because this isn't there and it's essentially double work every time I update my agents.