I was looking at the same today. To Ayn's point about adding in the field name, I made a few changes (in props.conf) and slightly changed another thing or two. It seems to be working well thus far.
[arbor_test]
EXTRACT-Extract src_port = (?i) source port (?P<src_port>\d+)
EXTRACT-category = (?i)^(?:[^ ]* ){5}(?P<category>[^ ]+)
EXTRACT-dest_ip = (?i) destination (?P<dest_ip>[^ ]+)
EXTRACT-signature = (?i) by (?P<signature>\w+\s+\w+)
EXTRACT-src_ip = (?i) host (?P<src_ip>[^ ]+)
EXTRACT-action = (?i) .*?: (?P<action>\w+)(?= )
EXTRACT-dest_port = (?i) .*?/(?P<dest_port>\d+)(?= )
EXTRACT-url = (?i),URL: (?P<url>.+)
EXTRACT-arbor_signature = (?i) by (?P<arbor_signature>.+?)\s+\w+\s+\d+
... View more