-1
07:40:28,339 INFO  [org.sprinframework.web.context.ContxtLoader] (ServerService Thread Pool -- 672)  WebApplicationContext: initialization started

I wrote the pattern like this 

grok { 
      match => { "message" => "%{TIME:timestamp}%{SPACE}%{WORD:loglevel}%{SPACE}%{DATA:classname}%{SPACE}%{DATA:url}{THREADPOOL:thread}%{SPACE}%{DATA:logs}" }

}
Lutz Prechelt
  • 36,608
  • 11
  • 63
  • 88
Amrit
  • 21
  • 4
  • Please read about [how to ask good questions](//stackoverflow.com/help/how-to-ask) and try to edit your question. With high quality questions you will receive better answers faster. More specifically, please include a question and what you tried and didn't work out (and why). Thanks! – Tobi Nary Jan 22 '16 at 11:08

1 Answers1

0

The grok pattern you need is:

%{TIME:timestamp}%{SPACE}%{LOGLEVEL:level}%{SPACE}\[(?<logger>[^\]]+)\]%{SPACE}\((?<thread>[^)]+)\)%{SPACE}%{GREEDYDATA:message}
jijinp
  • 2,592
  • 1
  • 13
  • 15