added x-forwarded-for for IIS grok filter