Logstashs event parsing

Try using a dissect filter to parse the first part of the line, and a kv filter for the rest.

    dissect { mapping => { "message" => "%{someNumber} [%{thread}] %{level} %{class} - %{[@metadata][restOfLine]}" } }
    kv { source => "[@metadata][restOfLine]" field_split => "," }