title: Logstash filter for spring boot logs to capture loglevel,class name
body: <p>I am trying to filter spring boot App logs using logstash using below configuration in filter block</p>
  
  <pre><code>filter {
  
   grok {
      match =&gt; [ "message",
                 "(?&lt;timestamp&gt;%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME})  %{LOGLEVEL:level} %{NUMBER:pid} --- \[(?&lt;thread&gt;[A-Za-z0-9-]+)\] [A-Za-z0-9.]*\.(?&lt;class&gt;[A-Za-z0-9#_]+)\s*:\s+(?&lt;logmessage&gt;.*)",
                 "message",
                 "(?&lt;timestamp&gt;%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME})  %{LOGLEVEL:level} %{NUMBER:pid} --- .+? :\s+(?&lt;logmessage&gt;.*)"
               ]
    }
  
  
    date {
      match =&gt; [ "timestamp" , "yyyy-MM-dd HH:mm:ss.SSS" ]
    }
  }
  </code></pre>
  
  <p>but it is not showing level,pid,class name in KIbana.
  <a href="https://i.stack.imgur.com/Y9nA4.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Y9nA4.png" alt="enter image description here"></a></p>
  
  <p>Few Lines from log file</p>
  
  <pre><code>2020-01-23 12:08:51.468 ERROR 13216 --- [http-nio-8085-exec-1] com.poc.SampleLog.DemoController         : java.lang.NullPointerException
  
  java.lang.NullPointerException: null
      at com.poc.SampleLog.DemoController.exception2(DemoController.java:36) ~[classes/:na]
      at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na]
      at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:na]
      at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na]
      at java.base/java.lang.reflect.Method.invoke(Method.java:566) ~[na:na]
  </code></pre>
  
  <p>What should I change in grok filter to capture loglevel,classname etc.
  Thanks in advance.</p>