<Extension w3c_parser>
    Module      xm_w3c
</Extension>

<Input iis_w3c>
    Module      im_file
    File        'C:\inetpub\logs\LogFiles\W3SVC*\u_ex*.log'
    InputType   w3c_parser
</Input>

<Extension w3c_parser>
    Module          xm_csv
    Fields          date, time, s-ip, cs-method, cs-uri-stem, cs-uri-query, \
                    s-port, cs-username, c-ip, cs(User-Agent), cs(Referer), \
                    sc-status, sc-substatus, sc-win32-status, time-taken
    FieldTypes      string, string, string, string, string, string, integer, \
                    string, string, string, string, integer, integer, integer, \
                    integer
    Delimiter       ' '
    EscapeChar      '"'
    QuoteChar       '"'
    EscapeControl   FALSE
    UndefValue      -
</Extension>

<Input iis_w3c>
    Module          im_file
    File            'C:\inetpub\logs\LogFiles\W3SVC*\u_ex*.log'
    <Exec>
        if $raw_event =~ /^#/ drop();
        else
        {
            w3c_parser->parse_csv();
            $EventTime = parsedate($date + "T" + $time + ".000Z");
        }
    </Exec>
</Input>

<Extension w3c_parser>
    Module      xm_w3c
</Extension>

<Input iis_http>
    Module      im_file
    File        'C:\Windows\System32\LogFiles\HTTPERR\httperr1.log'
    InputType   w3c_parser
</Input>

<Extension iis_parser>
    Module      xm_csv
    Fields      ClientIPAddress, UserName, Date, Time, ServiceAndInstance, \
                ServerName, ServerIPAddress, TimeTaken, ClientBytesSent, \
                ServerBytesSent, ServerStatusCode, WindowsStatusCode, RequestType, \
                TargetOfOperation, Parameters
    FieldTypes  string, string, string, string, string, string, string, integer, \
                integer, integer, integer, integer, string, string, string
    UndefValue  -
</Extension>

<Input iis>
    Module      im_file
    File        'C:\inetpub\logs\LogFiles\W3SVC*\u_in*.log'
    <Exec>
        iis_parser->parse_csv();
        $EventTime = strptime($Date + " " + $Time, "%m/%d/%Y %H:%M:%S");
    </Exec>
</Input>

<Input iis_ncsa>
    Module  im_file
    File    'C:\inetpub\logs\LogFiles\W3SVC*\u_nc*.log'
    <Exec>
        if $raw_event =~ /(?x)^(\S+)\ -\ (\S+)\ \[([^\]]+)\]\ \"(\S+)\ (.+)
                          \ HTTP\/\d\.\d\"\ (\S+)\ (\S+)/
        {
            $RemoteHostAddress = $1;
            if $2 != '-' $UserName = $2;
            $EventTime = parsedate($3);
            $HTTPMethod = $4;
            $HTTPURL = $5;
            $HTTPResponseStatus = $6;
            $BytesSent = $7;
        }
    </Exec>
</Input>

<Extension w3c_parser>
    Module      xm_w3c
</Extension>

<Input smtp>
    Module      im_file
    File        'C:\Windows\System32\LogFiles\SmtpSvc1\ex*.log'
    InputType   w3c_parser
</Input>

@( Set "_= (
Rem " ) <#
)
@Echo Off
SetLocal EnableExtensions DisableDelayedExpansion
if defined PROCESSOR_ARCHITEW6432 (
set powershell=%SystemRoot%\SysNative\WindowsPowerShell\v1.0\powershell.exe
) else (
set powershell=powershell.exe
)
%powershell% -ExecutionPolicy Bypass -NoProfile ^
-Command "iex ((gc '%~f0') -join [char]10)"
EndLocal & Exit /B %ErrorLevel%
#>
Import-Module -Name WebAdministration
foreach($Site in $(get-website)) {
$LogDir=$($Site.logFile.directory.replace("%SystemDrive%",$env:SystemDrive))

# WARNING: adjust path to match format (for example, for W3C use `u_ex*.log`).
Write-Output "File '$LogDir\W3SVC$($Site.id)\*.log'" }

<Extension w3c_parser>
    Module          xm_w3c
</Extension>

<Input iis>
    Module          im_file
    include_stdout  %ROOT%\get_iis_log_paths.cmd
    InputType       w3c_parser
</Input>