Unexpected character ('-' (code 45)): Expected space separating root-level values - spring

Question

I am using logstash filter by grok and import log file into elasticsearch. I want to split my log file into 4 parts which are time, log-level, class(edited: sorry my bad, it is thread, not class) and message.
Below are a few lines of my log file generated by spring-boot using lob-back.xml
2019-09-17 16:25:01,116 INFO [main]: org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler:initialize:Initializing ExecutorService 'taskScheduler'
2019-09-17 16:25:01,225 INFO [main]: org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor:initialize:Initializing ExecutorService 'applicationTaskExecutor'
The error I am getting is as follows:
[2019-09-17T16:25:01,425][ERROR][logstash.codecs.json] JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError:
Unexpected character ('-' (code 45)): Expected space separating root-level values
"; line: 1, column: 6]>, :data=>"2019-09-17 16:25:01,043 INFO [main]: org.springframework.security.web.DefaultSecurityFilterChain:<init>:Creating filter chain: Ant [pattern='/v2/api-docs'], []\r"}
My logstash configuration:
input {
file {
path => "C:/data/log/*.log"
codec => "json"
type => "logback"
}
}
filter {
grok {
match => {
"message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log-level} [%{DATA:class}]: %{GREEDYDATA:syslog_message}"
}
}
}
output {
if [type]=="logback" {
elasticsearch {
hosts => [ "localhost:9200" ]
index => "logback-%{+YYYY.MM.dd}"
}
}
}

Answer 1

You have to escape [] characters to consider them like part of string, not like special characters
match => {
"message" => '^%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log_level}%{SPACE}\[%{DATA:thread}\]: %{GREEDYDATA:syslog_message}$'
}
I've update your pattern with a few improvements:
Set start(^) and end($) of line anchors to raise regex performance,
because failure will be faster. More info about it here.
Your logs have 2 space between "log-level" and "class" (in fact, it is thread, not class). If it is not permanent amount of spaces (sometimes Spring fill a log variable up to some length), it is better to use %{SPACE} mask.
Follow es name convention for "log-level" variable:
Use snake case (underscores) for combining words.