title: LOGSTASH Grok , logstash-filter-json
body: <p>I have this log. I want to parse it with grok.</p>
  
  <pre><code>2017-05-29 00:00:12,145 INFO Identity:UserID=null;Correlation:BPID=null,BSID=f4dbd7f5-94e5-4c9d-bde6-ef0b6b0c6203,MID=null,PID=1494396441974578728;BUSINESS:InkassoService;2017_1;gibZahlstatus;231;OK;PID:1494396441974578728;UserID:xv86e0p;Channel:rv24;IDs:;ESBExecution:pid=1494396441975960958,workflow=Public/InkassoService/2017_1/gibZahlstatus/gibZahlstatus.wrf,status=1,proxyduration=200,workflowduration=200;
  </code></pre>
  
  <p>I've tried this pattern but without result:</p>
  
  <pre><code>%{TIMESTAMP_ISO8601:timestamp},\s*%{INT}\s*%{LOGLEVEL:log-level} :%{WORD:Identity}\S+%{WORD};:%{WORD:Correlation}\S+%{WORD},(?&lt;BSID&gt;[A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12},(?&lt;MID&gt;[A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}),(?&lt;PID&gt;[A-Fa-f0-9]{18});
  :%{WORD:BUSINESS};%{YEAR}_%{INT};%{NOTSPACE:RUF};%{NUMBER:server_response};%{NOTSPACE:termination_state};(?&lt;PID&gt;[A-Fa-f0-9]{18});(:%{HOSTNAME:UserID});(:%{HOSTNAME:Channel});%{NOTSPACE:IDS};:%{WORD:ESBExecution}\S+%{WORD},%{WORD}\S+%{URIPATH:uri},%{NUMBER:status},(?:%{BASE10NUM:workflowduration});(?:%{BASE10NUM:proxyduration})
  </code></pre>