[iis]: New Grok for more limited IIS options configured

### Integration Name

IIS [iis]

### Dataset Name

iis.access

### Integration Version

1.20.0

### Agent Version

8.15.4

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.15.4

### OS Version and Architecture

Windows Server 2019

### Software/API Version

Unknown

### Error Message

```
Provided Grok expressions do not match field value: [2024-11-15 16:25:59 WINYAMS1337 192.168.5.25 GET / helloWorldEatMe 80 yambot500 192.168.5.99 200 0 0 703 7 1]
```

### Event Original

_No response_

### What did you do?

Just tried to use the integration out of the box and none of the IIS logs were parsed for a few servers.

The solution: Created a new GROK expression to catch and IIS servers that use the same limited field configurations to get a match:

```
%{TIMESTAMP_ISO8601:iis.access.time} (?:-|%{NOTSPACE:iis.access.server_name}) (?:-|%{IPORHOST:destination.address}) (?:-|%{WORD:http.request.method}) (?:-|%{NOTSPACE:_temp_.url_path}) (?:-|%{NOTSPACE:_temp_.url_query}) (?:-|%{NUMBER:destination.port:long}) (?:-|%{NOTSPACE:user.name}) (?:-|%{IPORHOST:source.address}) (%{NUMBER:http.response.status_code:long}) (%{NUMBER:iis.access.sub_status::long}) (?:-|%{NUMBER:iis.access.win32_status:long}) (?:-|%{NUMBER:http.response.body.bytes:long}) (?:-|%{NUMBER:http.request.body.bytes:long}) (?:-|%{NUMBER:_temp_.duration:long})

```

### What did you see?

I saw that this is properly getting parsed in the system ingest pipeline:

```JSON
{
"_index": "index",
"_version": "-3",
"_id": "id",
"_source": {
"iis": {
"access": {
"server_name": "WINYAMS1337",
"sub_status": "0",
"win32_status": 0
}
},
"@timestamp": "2024-11-15T16:25:59.000Z",
"ecs": {
"version": "8.11.0"
},
"related": {
"user": [
"yambot500"
],
"hosts": [
"winyams1337"
],
"ip": [
"192.168.5.99",
"192.168.5.25"
]
},
"destination": {
"address": "192.168.5.25",
"port": 80,
"ip": "192.168.5.25"
},
"host": {
"name": "winyams1337"
},
"http": {
"request": {
"method": "GET",
"body": {
"bytes": 7
}
},
"response": {
"body": {
"bytes": 703
},
"status_code": 200
}
},
"source": {
"address": "192.168.5.99",
"ip": "192.168.5.99"
},
"event": {
"duration": 1000000,
"category": [
"web",
"network"
],
"type": [
"connection"
],
"kind": "event",
"outcome": "success"
},
"user": {
"name": "yambot500"
},
"url": {
"path": "/",
"original": "/",
"query": "helloWorldEatMe"
}
},
"_ingest": {
"pipeline": "_simulate_pipeline",
"timestamp": "2024-11-16T04:51:30.4515214Z"
}
}
```

### What did you expect to see?

I expect that the OOB IIS integration can handle a variety of different configurations for how IIS can be configured. Without this it will be a pain to manage this integration over time since I cannot use this custom GROK with the traditional @custom pipeline.

### Anything else?

Nope, pretty straight forward. Just add this new GROK and I will be happy.