I have the following log...
2017-03-27 14:24:50,607 DEBUG :Finalizer thread [com.company.classname]
...and the following filter
filter {
grok {
match => {
"message" => [
"%{TIMESTAMP_ISO8601:logdate}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}:%{HELP_WITH_PATTERN:thread}"
]
}
}
}
What should "HELP_WITH_PATTERN" be so I get thread => "Finalizer thread"