If you log entries have a standard prefix then I would normally suggest picking that off with dissect, then using grok against the various formats of the log.
In this case I would consider doing it with a csv filter.
csv { separator => " " columns => [ "COL_01", "COL_02", "COL_03", "COL_04", "[@metadata][restOfLine]" }
Then use grok with an array of pattern to match [@metadata][restOfLine]