Logstash grok split values in cookie string

Question

Want to split the following cookie information with grok in different fields.

Case 1

id=279ddd995;+user=Demo;+country=GB

Output

{ "id": "279ddd995", "user": "Demo", "country": "GB", }

Answer 1

try out following grok pattern

filter {
    grok {
         match => ["message", "id=(?<id>[^;]+);.*?user=(?<user>[^;]+);.*?country=(?<country>[^;]+).*?"]
    }
}