Making a grok filed optional in grok pattern

If that field is optional then you can use ? (zero or more) or {0,1} (zero or exactly one) to indicate that. The square brackets must be escaped to show that they are not part of a character group. Use parentheses to indicate what {0,1} applies to

(\[J2EE_APP.name: [-\w]+\]){0,1}

In some cases it is easier to search for multiple patterns.