Issue in parsing the data in logstash

[viki (Vignesh Kumar Koraki)]

Hi,

Facing parsing error with spaces,

Input :
2017-06-13 04:02:18,933 INFO [SIRAHULOG] (http-10.80.6.102-16013-25) Thread ID:221:AppSessionFilter:doPost:user session:Everything matched

We are grep "INFO" (it has two spaces between "INFO" and "[SIRAHULOG]" ) using below

grok {
match => {"message" => [
"^%{TIMESTAMP_ISO8601:time} %{LOGLEVEL:loglevel} [%{DATA:class}] %{GREEDYDATA:message}" ]
}

Output :
.
.
"loglevel" => "INFO",
.
.

But other than INFO like ERROR or FATAL logs we have only one space left between "ERROR" and "[SIRAHULOG]" . So , parsing fails

Example input :

2017-06-14 03:46:09,132 FATAL [SIRAHULOG] (WorkManager(2)-33) Thread ID:147:Error getting Entity Manager for firm 105471 Name : persistence-units/apptivodb3: firm id: 105471

[magnusbaeck (Magnus Bäck)]

Adjust your expression to allow for one or more spaces between the tokens:

^%{TIMESTAMP_ISO8601:time} +%{LOGLEVEL:loglevel} +[%{DATA:class}] +%{GREEDYDATA:message}