If you have a customized web log format, you may need to use Field Extraction to get the fields out of the log, depending on what your log looks like (can you tell us?).
Once you have extracted the fields, depending on how they are extracted, you may need to use Field Alias to make sure the fields are named correctly. Here is a list of field aliases that may be needed, taken from [access-extractions] in default/transforms.conf
[access-extractions]
# matches access-common or access-combined apache logging formats
# Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query, version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining chars)
# Note: referer is misspelled in purpose because that is the "official" spelling for "HTTP referer"
... View more