iis: fix error pipeline failing to parse HTTPERR lines with hyphenated methods

packages/iis/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.24.8"
+  changes:
+    - description: Fix `iis.error` pipeline failing to parse HTTPERR log lines that use a hyphenated HTTP method (for example, `M-POST`), which the grok pattern's `WORD` field could not match.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20273
 - version: "1.24.7"
   changes:
     - description: Add a grok pattern for access logs using the "s-ip ... cs(cookie) cs(Referer) ... sc-bytes, cs-bytes" documented field layout, which had no matching pattern and failed ingestion.

packages/iis/data_stream/error/_dev/test/pipeline/test-iis-error.log

@@ -6,3 +6,4 @@
 2018-05-05 05:05:55 67.43.156.15 12345 192.168.101.101 443 HTTP/1.1 GET /nessus\..\..\..\..\..\..\winnt\win.ini 403 - Forbidden -
 2018-05-05 05:05:55 67.43.156.15 12345 192.168.101.101 443 HTTP/1.1 OPTIONS * 404 - NotFound -
 2018-05-05 05:05:55 67.43.156.15 12345 192.168.101.101 443 HTTP/1.1 GET /fee&fie=foe 400 - URL -
+2026-05-25 05:21:53 67.43.156.15 51517 192.168.101.101 8181 HTTP/1.1 M-POST /CIMListener/\..\..\..\..\..\mydll 403 - Forbidden TCP

packages/iis/data_stream/error/_dev/test/pipeline/test-iis-error.log-expected.json

@@ -533,6 +533,73 @@
                 "original": "/fee&fie=foe",
                 "path": "/fee&fie=foe"
             }
+        },
+        {
+            "@timestamp": "2026-05-25T05:21:53.000Z",
+            "destination": {
+                "address": "192.168.101.101",
+                "ip": "192.168.101.101",
+                "port": 8181
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "category": [
+                    "web",
+                    "network"
+                ],
+                "kind": "event",
+                "original": "2026-05-25 05:21:53 67.43.156.15 51517 192.168.101.101 8181 HTTP/1.1 M-POST /CIMListener/\\..\\..\\..\\..\\..\\mydll 403 - Forbidden TCP",
+                "outcome": "failure",
+                "type": [
+                    "connection"
+                ]
+            },
+            "http": {
+                "request": {
+                    "method": "M-POST"
+                },
+                "response": {
+                    "status_code": 403
+                },
+                "version": "1.1"
+            },
+            "iis": {
+                "error": {
+                    "queue_name": "TCP",
+                    "reason_phrase": "Forbidden"
+                }
+            },
+            "related": {
+                "ip": [
+                    "67.43.156.15",
+                    "192.168.101.101"
+                ]
+            },
+            "source": {
+                "address": "67.43.156.15",
+                "as": {
+                    "number": 35908
+                },
+                "geo": {
+                    "continent_name": "Asia",
+                    "country_iso_code": "BT",
+                    "country_name": "Bhutan",
+                    "location": {
+                        "lat": 27.5,
+                        "lon": 90.5
+                    }
+                },
+                "ip": "67.43.156.15",
+                "port": 51517
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "url": {
+                "original": "/CIMListener/\\..\\..\\..\\..\\..\\mydll"
+            }
         }
     ]
 }

packages/iis/data_stream/error/elasticsearch/ingest_pipeline/default.yml

@@ -14,12 +14,12 @@ processors:
       patterns:
       - '%{TIMESTAMP_ISO8601:iis.error.time} %{IPORHOST:source.address} %{NUMBER:source.port:long}
         %{IPORHOST:destination.address} %{IPORHOST:destination.port:long} (?:HTTP/%{NUMBER:http.version}|-)
-        (?:%{WORD:http.request.method}|-) (?:-|%{NOTSPACE:_tmp.url_orig}) (?:%{NUMBER}|-)
+        (?:-|%{NOTSPACE:http.request.method}) (?:-|%{NOTSPACE:_tmp.url_orig}) (?:%{NUMBER}|-)
         (?:%{NUMBER:http.response.status_code:long}|-) (?:%{NUMBER}|-) (?:-|%{NOTSPACE:iis.error.reason_phrase})
         (?:-|%{NOTSPACE:iis.error.queue_name})'
       - '%{TIMESTAMP_ISO8601:iis.error.time} %{IPORHOST:source.address} %{NUMBER:source.port:long}
         %{IPORHOST:destination.address} %{IPORHOST:destination.port:long} (?:HTTP/%{NUMBER:http.version}|-)
-        (?:%{WORD:http.request.method}|-) (?:-|%{NOTSPACE:_tmp.url_orig}) (?:%{NUMBER:http.response.status_code:long}|-)
+        (?:-|%{NOTSPACE:http.request.method}) (?:-|%{NOTSPACE:_tmp.url_orig}) (?:%{NUMBER:http.response.status_code:long}|-)
         (?:%{NUMBER}|-) (?:-|%{NOTSPACE:iis.error.reason_phrase}) (?:-|%{NOTSPACE:iis.error.queue_name})'
       ignore_missing: true
   - uri_parts:

packages/iis/manifest.yml

@@ -1,6 +1,6 @@
 name: iis
 title: IIS
-version: "1.24.7"
+version: "1.24.8"
 description: Collect access logs, error logs, and performance metrics from IIS on Windows via Elastic Agent.
 type: integration
 icons: