I wouldnt use grok for that as its overkill, i would use some regex to remove the first two values, or grab them if you need them, and then i would use the key value function for the rest, it should make quick work of that and use much less cpu. And its alot easier to write.