Logstash grok pattern for space field

Question

Hi How to write a grok expression for the below log

[2017-03-25T00:00:07,137][WARN ]

match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}/]/[%{LOGLEVEL:log-level}\s*\]" }

Is this correct , how to write space in grok ? Thanks

Nonentity

Answer 1

%{SPACE} is that pattern that matches 0 or more spaces, which is very useful if you don't know (or care!) if there will be a space or not.

Volsung

Thanks! very usefull. Sometimes you don't notice that you have more spaces between log fields.... – Judson

try %{SPACE}* as mentioned here – Infusorian

I was searching for the same .. found this works: \s+ – Staggard

trim every space until next character. Thank you! – Thurber