iis: fix error pipeline failing to parse HTTPERR lines with hyphenated methods

[stefans-elastic]

Proposed commit message

The iis.error ingest pipeline's grok processor matched the HTTP request method with %{WORD:http.request.method}. WORD only matches \w+, so it cannot match a hyphen. HTTP Extension Framework verbs such as M-POST therefore caused the whole grok processor to fail to match, and the event was routed to on_failure instead of being parsed.

Before: an HTTPERR line such as

2026-05-25 05:21:53 95.181.237.34 51517 10.10.0.16 8181 HTTP/1.1 M-POST /CIMListener/\..\..\..\..\..\mydll - - 403 - Forbidden - TCP

fails to match either grok alternative in the pipeline (both require %{WORD:http.request.method}), so the document ends up in on_failure with an error.message instead of being parsed.

After: both grok alternatives now use (?:-|%{NOTSPACE:http.request.method}) for the method field (mirroring the dash-first alternation already used elsewhere in this same pipeline for the URI, reason and queue fields), so:

• A hyphenated/non-standard method like M-POST is captured correctly as http.request.method.
• A literal - (no method logged) still leaves http.request.method unset, exactly as before — this dash-first ordering was chosen over a plain %{WORD:...} → %{NOTSPACE:...} swap because a naive swap (keeping NOTSPACE first in the alternation) would instead capture the literal - as the string -, which is a regression against the existing pipeline tests (e.g. the "reason-only" HTTPERR lines that have no method/URI/status at all).

Added a new pipeline test case (M-POST request against a backslash path-traversal URI) to packages/iis/data_stream/error/_dev/test/pipeline/test-iis-error.log / test-iis-error.log-expected.json, and bumped the package version with a changelog entry.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices (n/a, no dashboard changes)

Author's Checklist

• Verified the grok pattern change against all existing error pipeline test fixtures (no regressions)
• Verified the new M-POST test case parses with the expected fields
• Verified the customer's exact reported HTTPERR line, which is not WORD-safe, now matches the grok pattern (previously it matched nothing and went to on_failure)

How to test this PR locally

elastic-package test pipeline --data-streams error

This runs the pipeline tests in packages/iis/data_stream/error/_dev/test/pipeline/ against a real Elasticsearch ingest simulate, including the new M-POST case.

---

Generated by Claude Code

[cla-checker-service]

💚 CLA has been signed

[mergify]

⚠️ The sha of the head commit of this PR conflicts with #20242. Mergify cannot evaluate rules on this PR. Once #20242 is merged or closed, Mergify will resume processing this PR. ⚠️

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 57bf2d3

History

• 💚 Build #46434 succeeded 2bb895e
• 💔 Build #46433 failed 35c2e99