How to Logstash gork filter with different infos in syslog message field

Elastic Stack Logstash
6

Thanks @magnusbaeck.

After reading some documents and testings, the following easy filter works for me (without _grokparsefailure):

filter {
if [type] == "syslog" {
grok {
match => { "message" => "\|%{IPV4:Dst-IP}\|%{INT:Dst-Port}\|%{USERNAME:Dst-Service}\|%{WORD:Dst-Inf}\|%{WORD:Rule-Name}"}
match => { "message" => "\|%{IPV4:Dst-IP}\|%{INT:Dst-Port}\|%{USERNAME:Dst-Service}\|\|%{WORD:Rule-Name}"}
match => { "message" => "\|%{IPV4:Dst-IP}\|%{INT:Dst-Port}\|\|\|%{WORD:Rule-Name}"}
}
}
}

Kind regards
Jiona