Grok filter for Cloudfront Logs to be used with Logstash & ElasticSearch

logstash.conf

filter {
    grok {
        match => [
            "message", "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}[\t]%{TIME:time}[\t](?<x_edge_location>\b[\w\-]+\b)[\t](?:%{NUMBER:sc_bytes}|-)[\t]%{IPORHOST:clientip}[\t]%{WORD:cs_method}[\t]%{HOSTNAME:cs_host}[\t]%{NOTSPACE:cs_uri_stem}[\t]%{NUMBER:sc_status}[\t]%{GREEDYDATA:referrer}[\t]%{GREEDYDATA:agent}[\t]%{GREEDYDATA:cs_uri_query}[\t]%{GREEDYDATA:cookies}[\t]%{WORD:x_edge_result_type}[\t]%{NOTSPACE:x_edge_request_id}[\t]%{HOSTNAME:x_host_header}[\t]%{GREEDYDATA:cs_protocol}[\t]%{INT:cs_bytes}[\t]%{GREEDYDATA:time_taken}[\t]%{GREEDYDATA:x_forwarded_for}[\t]%{GREEDYDATA:ssl_protocol}[\t]%{GREEDYDATA:ssl_cipher}[\t]%{GREEDYDATA:x_edge_response_result_type}[\t]%{GREEDYDATA:cs_protocol_version}"
        ]
    }
    geoip {
        source => "c_ip"
    }
    mutate {
        add_field => ["listener_timestamp", "%{year}-%{month}-%{day} %{time}"]
        convert => { 
        	"[geoip][coordinates]" => "float" 
        	"sc_bytes" => "integer"
        	"cs_bytes" => "integer"
        	"time_taken" => "float"
        }
    }
    date {
        match => ["listener_timestamp", "yyyy-MM-dd HH:mm:ss"]
    }
}

x_edge_location can contain dash, WORD group doesn't allow for it.