Grok: filter options match not create new field

[Ret]

Hi everyone !

I am collecting Windows Event Logs from winlogbeat with Logstash. And I have some problem grok filter.

I created custom pattren for find user account in event log ..... And the pattern working in Kibana Grok Debuger but grok filter not create new field.

Text wich need parsing

TF53010: The following error has occurred in a Team Foundation component or extension:
Date (UTC): 3/1/2019 9:55:44 AM
Machine: ALMVMTEST2
Application Domain: /LM/W3SVC/2/ROOT/tfs-1-131956424397262984
Assembly: Microsoft.TeamFoundation.Framework.Server, Version=16.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a; v4.0.30319
Service Host: d162e475-ce02-44b3-b3c5-9da898c7efed (DefaultCollection)
Process Details:
Process Name: w3wp
Process Id: 4220
Thread Id: 5412
Account name: contoso\user

Grok pattern config file winevent.grok:

EVENT_ACCOUNT (?<=Account name: ).*(?<!\s)

logstah config

    input {
      beats {
        port => 5044
      }
    }

    filter {
        grok {
    	patterns_dir => "/etc/logstash/patterns"
    	match => { "message" => ["%{EVENT_ACCOUNT}: Account"] }

         }
    }


    output {
      stdout { 
    	codec => rubydebug
        }
     
      elasticsearch {
        hosts => ["http://localhost:9200"]
        index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
        #user => "elastic"
        #password => "changeme"
      }
    }

Any thoughts why not working?
Thanks!

[Badger]

Since account name is the last item in the message you can use

    grok { match => { message => "^Account name: (?<accountName>.*)" } }

If you wanted to extract a line from the middle of the message you could use a pattern that matches zero-or-more characters that are not newline followed by a newline.

    grok { match => { message => "^Process Name: (?<processName>[^
]*)
" } }

[Ret]

@Badger, thank you very much. This solved my problem.

Pattern that works for me:

grok { match => { message => "Process Name: (?<processName>[^\s]*)" } }