Works for me:
$ cat data
[21/Apr/2015:00:00:02 +0200] - 66.249.78.123 www.mydomain.no A7CEE20E7E0A5F1C5727E0036B868422.agap67 - GET /myuri/foobar/search-result.action?richList=false&projectRows=50&productRows=50&authorRows=50&articleRows=50&otherFacets=ft_academical_subject%3ASamfunnsvitenskap%7C%3B%3Bf_digital_type%3AApp 200 265ms
$ cat test.config
input { stdin { codec => plain } }
output { stdout { codec => rubydebug } }
filter {
grok {
match => [
"message",
"\[%{HTTPDATE:timestamp}\] \- %{IP:client} %{HOSTNAME:hostname} %{WORD:jsessionId}.%{WORD:node} - %{WORD:method} %{URIPATHPARAM:request} %%{INT:size} %{WORD:responsetime}"
]
}
}
$ /opt/logstash/bin/logstash -f test.config < data
{
"message" => "<feff>[21/Apr/2015:00:00:02 +0200] - 66.249.78.123 www.mydomain.no A7CEE20E7E0A5F1C5727E0036B868422.agap67 - GET /myuri/foobar/search-result.action?richList=false&projectRows=50&productRows=50&authorRows=50&articleRows=50&otherFacets=ft_academical_subject%3ASamfunnsvitenskap%7C%3B%3Bf_digital_type%3AApp 200 265ms",
"@version" => "1",
"@timestamp" => "2015-05-08T09:49:14.347Z",
"host" => "seldlx20533",
"timestamp" => "21/Apr/2015:00:00:02 +0200",
"client" => "66.249.78.123",
"hostname" => "www.mydomain.no",
"jsessionId" => "A7CEE20E7E0A5F1C5727E0036B868422",
"node" => "agap67",
"method" => "GET",
"request" => "/myuri/foobar/search-result.action?richList=false&projectRows=50&productRows=50&authorRows=50&articleRows=50&otherFacets=ft_academical_subject%3ASamfunnsvitenskap%7C%3B%3Bf_digital_type%3AApp",
"size" => "200",
"responsetime" => "265ms"
}