Grok space expression optional

Elastic Stack Logstash
1

Hi there,
In my environments I have the following log files:

Domain name: WORKGROUP
Console user name:Administrator
Console user groups: [Administrators,]
Logged in users: [Administrator,]
OS version: Windows 10
OS Platform: x64
Current System Time:2018-08-06T04:14:32-07:00

And I use this grok match to parse this line(line by line):

   grok {
    match => { "message" => "%{GREEDYDATA:key_info}:%{GREEDYDATA:value_info}" }
        }

All the line parse well except for the last line,
the problem in this line is the 'space' - as you can see all the line have space between ':' to the value, and in the last line the ':' connected to value.
How can I making a part in the grok expression optional?
Thanks

2

An optional space would be \s?
But you have another problem: Your value contains ':', so the first GREEDYDATA includes way too much:

{
  "key_info": [
    [
      "Current System Time:2018-08-06T04:14:32-07"
    ]
  ],
  "value_info": [
    [
      "00"
    ]
  ]
}

Try

(?<key_info>[^:]*):\s?%{GREEDYDATA:value_info}
(The key may contain any character but a colon.)

or

(?<key_info>.*?):\s?%{GREEDYDATA:value_info}
(The key may contain any character, but as little as possible.)

3

The first one work great !
Thanks!