You would replace everything after '%{WORD:service}: ' (that has a trailing space) with %{GREEDYDATA:message}. Then look at the output and realize you don't want to call it message 
You would replace everything after '%{WORD:service}: ' (that has a trailing space) with %{GREEDYDATA:message}. Then look at the output and realize you don't want to call it message
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.