It's not immediately obvious what's wrong. General comments:
- I'd be careful about those multiple DATA patterns. Unless you're very careful they might match things in unexpected ways.
- In your example you're attempting to capture "org.mariadb.jdbc.internal.mysql.MySQLProtocol getResult" into the field
thread, which doesn't seem to make sense. I'm sure "org.mariadb.jdbc.internal.mysql.MySQLProtocol" is the logger name and "getResult" looks like a method name. I suggest you use the NOTSPACE pattern to match these two tokens individually. - To debug things like this start with the simplest possible pattern, like
%{MONTH}. If that works, add another token (%{MONTH} %{MONTHDAY}). Continue until things break. Then you've narrowed things down, hopefully enough to make it trivial to spot the problem.