grok debugger regex usage - elasticsearch

Question

I'm testing grok debugger, but I cannot get it to solve my problem.
sample text:
2014-06-17 04:37:30,317 c.e.A.MyActivity INFO main MyActivity.java 53 com.example.ApLogback.MyActivity$1 onClick logger track
How should I construct a grok regex/pattern string, so that it splits the previous sample text like in the following parts:
{
timestamp:2014-06-17 04:37:30,317
logger:c.e.A.MyActivity
level:info
caller_thread:main
caller_method:MyActivity.java
caller_line:53
caller_class:com.example.ApLogback.MyActivity$1
caller_method: onClick
msg: caller track
}
My current regex is:
(?<timestamp>[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3}) (?<logger>.*)
but it only splits the begining of the log string in parts. An example result of my current grok string is:
{
"timestamp": [
[
"2014-06-17 04:37:30,317"
]
],
"logger": [
[
"c.e.A.MyActivity INFO main MyActivity.java 53 com.example.ApLogback.MyActivity$1 onClick logger"
]
]
}

Answer 1

Grok comes with many already-defined patterns that will cover most of your needs, check them out at: Grok Debugger/patterns
As for a concrete answer to your question, here is a quick an dirty example that does what you need. It is just an example of how you can go about using already defined grok patterns to build your own pattern.
(?<timestamp>[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3}) (?:%{JAVACLASS:logger}) (?:%{LOGLEVEL:level}) (?:%{WORD:caller_thread}) (?:%{JAVACLASS:caller_file}) (?:%{NONNEGINT:caller_line}) (?:%{JAVACLASS:caller_class}) (?:%{WORD:caller_method}) (?:%{GREEDYDATA:msg})