how should i define grok match pattern for below log pattern

Question

Log Pattern i am using

2018-06-18 18:25:25.424 ERROR 2688 --- [io-8052-exec-16] c.l.o.u.s.i.ClientCallbackServiceImpl   , 239 : Unable to inform client about the order callback status: Exception occured is: {}

Answer 1

You don't really need grok for that, you can simply use dissect {}.

So if your message is:

2018-06-18 18:25:25.424 ERROR 2688 --- [io-8052-exec-16] c.l.o.u.s.i.ClientCallbackServiceImpl , 239 : Unable to inform client about the order callback status: Exception occured is: {}

Then your dissect would be something like this, be careful to preserve the spaces:

dissect {
  mapping => {
    "message" => "%{date} %{time} %{log_level} %{log_level_code} --- [%{process}] %{class} , %{line} : %{log_message}"
  }
}

You would need then to combine the fields date and time in another field using mutate and use the date filter to make it a timestamp.

mutate {
    add_field => {"log_date" => "%{date} %{time}"}
}
date {
    match => [ "log_date", "yyyy-MM-dd HH:mm:ss.SSS" ]
}