Help with using Grok to parse these three log formats

[Badger]

@roman-tasi

If you can give me a pattern that would work

Don't try to match the entire line with a pattern. Just pull out the fields you need

    grok {
        break_on_match => false
        match => {
            "message" => [
                "account=(?<account>[^;]*);",
                "DeviceType=%{WORD:deviceType}",
                "\[ip=%{IPV4:ip}",
                "oip=%{IPV4:oip}",
                "protocol=%{WORD:protocol}"
            ]
        }
    }