The problem was that the format log has been changed without my Knowledge.
Before:
[4/7/16 12:39:39:813 CET] 00000249 SystemOut O lookupName: java:comp/env/ejb/StructureInformation
After:
[4/7/16 12:39:39:813 CEST] 00000249 SystemOut O lookupName: java:comp/env/ejb/StructureInformation
So, I changed the filter to recognize this new format as bellow.
Before:
match => ["message", "([%{DATESTAMP:timestamp} (\S{3}))\S %{WORD:thread_id} %{WORD:short_name}\s*%{WORD:event_type}\s*%{GREEDYDATA:m
essage_desc}"]
After:
match => ["message", "([%{DATESTAMP:timestamp} (\S)*)] %{WORD:thread_id} %{WORD:Short_name}\s*%{WORD:event_ty
pe}\s*%{GREEDYDATA:message_desc}"]