Help with Grok pattern with space in field?

I have the following log...

2017-03-27 14:24:50,607 DEBUG :Finalizer thread []

...and the following filter

filter {
  grok {
    match => {
      "message" => [

What should "HELP_WITH_PATTERN" be so I get thread => "Finalizer thread"

I should read my own posts

you could also create your own pattern:

Then call that:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.