With this pattern, with a bracket after the %X expression :
<pattern>BEFORE %X

{req.remoteHost}) AFTER %n</pattern>
I have the following (broken) log messages :
BEFORE 127.0.0.1BEFORE 127.0.0.1BEFORE 127.0.0.1

With this pattern, without a bracket after the %X expression :
<pattern>BEFORE %X{req.remoteHost}

AFTER %n</pattern>
I have the following (nice) log messages :
BEFORE 127.0.0.1 AFTER
BEFORE 127.0.0.1 AFTER

BEFORE 127.0.0.1 AFTER