Grok Pattern to extract brackets content

Elastic Stack Logstash
4

Grok patterns can get pretty complex; I prefer to start with the Dissect filter, and only move on to Grok if I encounter input that cannot be handled by Dissect. Dissect is especially great because you don't have to define perfect patterns for each captured variable, so it's easier to get things right.

Here, I've used your names for things and applied it to a Dissect matcher.

filter {
  # first, split the message into component parts. I don't know
  # what the format of yours means, so I used the dissect filter
  # to split on the `:JMIX:` sequence. You can use grok if you'd
  # like to achieve similar. The point though, is that the entire
  # key/value sequence is put in a single var `[@metadata][kv]`.
  dissect {
     mapping => {
        "message" => "%{}|%{info}-%{ID2}:%{mgs_level}: %{[@metadata][kv]}"
      }
  }
  # now we use the KV filter to split that up. This won't work well
  # if your squiggle-bracket-quoted values contain squiggle-brackets,
  # since it has no way to differentiate between a _meaningful_
  # squiggle-bracket and a _literal_ one.
  kv {
    "source" => "[@metadata][kv]"
    "field_split" => "}"
    "value_split" => "{"
    "trim_key" => " "
    "trim_value" => " "
  }
}

With your input, the rubydebug output looks like:

{
                  "ID2" => "00088",
            "mgs_level" => "JMIX",
             "Snapshot" => "false",
                 "info" => "5860",
    "ChainSubscription" => "INFO",
               "Action" => "Update",
                "Chain" => "MOVE.AA_MOVE_TOP.ABC_SWITCH_COMP_GO.SHOP_ABC",
              "message" => "14:10:49:158017|5860-00088:JMIX: ChainSubscription {INFO} Action {Update} Chain {MOVE.AA_MOVE_TOP.ABC_SWITCH_COMP_GO.SHOP_ABC} Snapshot {false}",
             "@version" => "1",
                 "host" => "castrovel.local",
           "@timestamp" => 2018-09-26T17:17:50.758Z
}