Advanced logging is enabled on exchange as the mail servers are behind a F5. X-Forwarded-For is configured to pass the clientip.
It looks some logs don't have the s_ip fields. Not sure why? Instead of tuning the field extraction right away, I believe there should have some easier way to do the adaption.