Groking Issue with Multiple data formats

\s* means "zero or more whitespace characters", which isn't correct in your case since you really want there to be a space before and after the log level (for example). Use \s+ for "one or more whitespace characters" instead.