Take a look at the section of the grok filter documentation called "Custom Patterns". That defines a capture group that creates a field on the event called g1, which consists of a single character from the message (which is what . matches). The \s means whitespace, which you were already using.
You might want to try running logstash on the command line with this configuration