Grok Extractor Grok Pattern Help

[williamk (Charlie Kangas)]

Im a newb to Grok and regular expressions, so forgive my ignorance. Have a Cisco Firepower syslog message that I want to extract the value for EgressZone. In the message I have the string
EgressZone: HA-Guest-Outside-Zone, IngressZone:

So I want to extract the value HA-Guest-Outside-Zone and assign it to the field EgressZone. I create a Grok Pattern extractor that looks like this:
EgressZone: %{WORD:EgressZone}

This extractor returns HA. Apparently the filter for WORD does not include hyphens. Most of my values for Egress zone include one to three hyphens. What would the correct filter be to include hyphens in a word. Or is their a way to create a grok pattern that will Extract all characters after EgressZone: up to the comma? Perhaps a Grok Pattern is not the correct choice for this extractor?

[Ponet (Jesse Hills)]

You could try something like:
EgressZone:\s%{GREEDYDATA:EgressZone},\sIngressZone:\s%{GREEDYDATA:IngressZone}

The GREEDYDATA grok pattern is effectively just .* (aka EVERYTHING)

[williamk (Charlie Kangas)]

Thank you, GREEDYDATA put me on the right path. I also figured out that the NOTSPACE pattern in this case also gave me the data I wanted. As I understand it that pattern basically returns everything up to the first space.