thanks for lighting me up, shoothub, that did the magic trick
devname=%{NOTSPACE:vpnhost} %{GREEDYDATA:UNWANTED} vd=%{NOTSPACE:vdom} %{GREEDYDATA:UNWANTED} user=%{NOTSPACE:user} %{GREEDYDATA:UNWANTED} sentbyte=%{BASE10NUM:sent} rcvdbyte=%{BASE10NUM:rcvd}