Here the answer to your question. The thing that you had missing is DATA which means that pattern starts with ANY type of Data until it finds your specific LogRecord.Security and then it puts the value into the variable severity