Logstash Grok Patterns

filter {
    if [program] == "lcsam" {
        grok {
            match => [
                'message', '%{IP:client_ip}: %{WORD:lcsam_action} \(%{WORD:lcsam_result} %{NUMBER:lcsam_score}/%{NUMBER:lcsam_warn}/%{NUMBER:lcsam_reject} %{NOTSPACE:lcsam_tests}\), From: %{DATA:lcsam_from}, To: %{DATA:lcsam_to}, Subject: %{GREEDYDATA:lcsam_subject}'
            ]
        }
        if [client_ip] {
            geoip {
                source => "client_ip"
            }
        }
        mutate {
            split => [
                'lcsam_tests', ','
            ]
            convert => [
                # list of float fields
                'lcsam_score', 'float',
                'lcsam_warn', 'float',
                'lcsam_reject', 'float'
            ]
        }
    }
}