Need Help Groking

I would not use grok for that, I would use dissect to parse off everything up to the : after the pid, and then use a kv filter for the rest of the line, then maybe use prune with a whitelist to clean up the kv output.

Alternatively, set break_on_match to false, and grok out all the individual fields. Do not put .* between them, just enter each pattern like srcip="%{IP:source.ip}" into the array.