title: What should be the logstash grok filter for this log4j log?
body: <p>I've been asked to consolidate our log4j log files (NOT using Socket calls for now) into a Logstash JSON file that I'll then feed to Elasticsearch. Our code use the RollingFileAppender. Here's an example log entry.</p>
  
  <pre><code>2016-04-22 16:43:25,172 ERROR :SomeUser : 2 [com.mycompany.SomeClass]  AttributeSchema 'Customer |Customer |Individual|Individual|Quarter|Date' : 17.203 The Log Message.
  </code></pre>
  
  <p>Here's the ConversionPattern value in our log4j.properties file</p>
  
  <pre><code>&lt;param name="ConversionPattern" value="%d{ISO8601} %p %x %X{username}:%t [%c] %m %n" /&gt;
  </code></pre>
  
  <p>Can someone please help me write a Logstash Grok filter that will parse the line? I have the following so far</p>
  
  <pre><code>filter {
    if [type] == "log4j" {
      grok {
          match =&gt; ["message", "%{TIMESTAMP_ISO8601:logdate} %{LOGLEVEL:loglevel} %{GREEDYDATA:messsage}"]
      }
      date {
          match =&gt; ["logdate", "yyyy-MM-dd HH:mm:ss,SSS", "ISO8601"]
      }
    }
  }
  </code></pre>
  
  <p>But of course it takes everything after the priority as the message. I want to further segregate AT LEAST the following fields (defined in <a href="http://www.tutorialspoint.com/log4j/log4j_patternlayout.htm" rel="noreferrer">Log4j Pattern Layout</a>)</p>
  
  <ul>
  <li>User (%X{username})</li>
  <li>Classpath ([%c])</li>
  <li>Thread (%t)</li>
  <li>Nested Diagnostic Content (%x)</li>
  <li>Message itself (%m)</li>
  </ul>