取 appId=

日志内容
211.138.116.232 - - [24/May/2018:17:58:55 +0800] 200 448 0.001 0.001 http log.9wuli.com "GET /v4/report/message/view?appId=9214dr45d13ab9212c5235fafe82c4d4&appSecrect=a943ff9a630c3c01cdf45t44f354f860&messageId=cmsgsbuluxymn&messageType=NEWS&eventId=1202&time=1527155935637 HTTP/1.1" "http://sds.9edu.com/sdk/defaul ... ot%3B "Mozilla/5.0 (Linux; Android 7.1.1; 1607-A01 Build/NMF26F; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/59.0.3071.82 Mobile Safari/537.36" "-" "-"
 
grok这样写的，是不是哪里写的不太对
    grok {
        match => {
            "request" => "(\S+appId=%{WORD:appId}&?\S+)"
        }
 }