title: getting rid of colon in grok
body: <p>Basically I was setting up an Elasticsearch-Logstash-Kibana (elk) stack for monitoring syslogs. Now I have to write the grok pattern for logstash.</p>
  
  <p>Here's an example of my log:<br>
  <code>May  8 15:14:50 tileserver systemd[25780]: Startup finished in 29ms.</code></p>
  
  <p>And that's my pattern (yet):<br>
  <code>%{SYSLOGTIMESTAMP:zeit} %{HOSTNAME:host} %{SYSLOGPROG:program}</code><br>
  Usually I'm also using <code>%{DATA:text}</code> for the message but it just works on the link below.</p>
  
  <p>I'm using <a href="https://grokconstructor.appspot.com/do/match" rel="nofollow noreferrer">Test grok patterns</a> to test my patterns and these 3 work fine but there's the colon (from after PID) in front of the message and I don't want it to be there.
  How do I get rid of it?</p>