Obvious from question, I've been trying to look for fault for so long but still don't seem to be coming around solution. Here's config
filter{
grok{
pattern_definitions => {
"CUSTOMMONTH" => "(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)"
"CUSTOMTIMESTAMP" => "%{MONTHDAY}/%{CUSTOMMONTH}/%{YEAR} %{TIME}"
}
match=>{
"message" => ["%{CUSTOMTIMESTAMP:time}",
"\"%{WORD:method} %{DATA:url} HTTP"]
"@version" => "%{NUMBER:num}"
}
add_field=>{"user"=>"url1" }
}
}
"message" => "{"log":"[08/Jun/2022 03:29:16] "GET /cart/ HTTP/1.1" 200 16123\n","stream":"stderr","time":"2022-06-08T03:29:16.583783858Z"}"
Matches well on online debugger and ignore @version matching part because that works well.