How to account for different number of blank spaces in Log4j logs?

Elastic Stack Logstash
1

I have the following log4j logs

2016-04-22 16:43:25,172 ERROR :SomeThread : 2 [com.mycompany.SomeClass]  The Log Message.
2016-06-11 01:22:40,894 INFO  :SomeThread1 : 0 [com.mycompany.SomeClass1] The Log message

I have the following Grok filter

filter {
    mutate {
      strip => "message"
    }
    grok {
      match => {
        "message" => "%{TIMESTAMP_ISO8601:logdate} %{LOGLEVEL:loglevel} :%{DATA:thread} : %{NUMBER:thread_pool} \[(?<classname>[^\]]+)\] %{SPACE} %{GREEDYDATA:msgbody}"
      }
    }
    date {
      match => ["logdate", "yyyy-MM-dd HH:mm:ss,SSS", "ISO8601"]
    }
}

However it only works for the ERROR log and not the INFO log, since ERROR takes up 5 spaces, and INFO 4 spaces, so there is ONE space between ERROR and :SomeThread, whereas there are TWO spaces between INFO and :SomeThread1.

How can I account for the different number of spaces between fields when writing Grok patterns?

2

I was actually messing with some extra spaces in grok today. My logs varied between 1 to 5 spaces and instead of putting actual spaces I used \s+ which is the regular expression for 1 or more spaces.
Try putting \s+ at the end of %{LOGLEVEL:loglevel} and see if that does the trick.

3

Using %{SPACE} did the trick for me. So here's the filter

%{TIMESTAMP_ISO8601:logdate}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}:%{DATA:thread}%{SPACE}:%{SPACE}%{NUMBER:thread_pool}%{SPACE}\[(?<classname>[^\]]+)\]%{SPACE}%{GREEDYDATA:msgbody}

I'll try @marke72 idea too.

4

They both should work. %{SPACE} is just \s* I just use \s+ because I'm expecting at least one space.
Here's a reference https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns

5

Yep makes sense now. I'm new to this too.