Ok, it seems the problem was here:
\s+[%{DATA:className}]
I'm trying to parse the "class name" part of the message, I've tried the following as well but with no luck:
%{TIMESTAMP_ISO8601:timestamp}%{SPACE} %{LOGLEVEL:level} %{SPACE} %{SPACE} \[%{JAVACLASS:class}\] %{SPACE} %{GREEDYDATA:message}
Thanks