GROK Filter for class / thread regex help please

trying to tackle a expression but im a novice.

Need to match the log4j thread name

${NOSPACE:thread} worked until I encountered spaces then spaces and brackets

need to match the following
mulesoftlogs withaspace
[mulesoftlogs with spacesandbrackets]

for the space and brackets I found the following solution online


Then I ran into a about a dozen lined with this

[mulesoftlogs with a [[spaceand2brackets]]

which this pattern worked despite missing the trailing bracket in the resulting value

Then the last few grok failures stumped me.

[mulesoftlogs withaspace ]andbracketsfaceingalldirections]]

not good enough to make this for in logstash ..

any help is appreciated thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.