This is a tricky file to parse because the message, context and 'extra' are all separated by a single space. This does not sufficiently delineate where one field stops and another begins.
The LogViewPlus default parser is pretty good in this case which just treats all three fields as a message. Messages can then be
parsed separately where needed, so this isn't a bad option.
[%d{yyyy-MM-dd %H:mm:ss ZZZ}] %c.%p: %m%n
You could also parse out the message and detail by ending the message on the '{' character. This would treat the context as part of the message. Something like:
[%d{yyyy-MM-dd %H:mm:ss ZZZ}] %c.%p: %m {%S{Detail}%n
It looks like there is another problem here too. The 'context' field looks like it may be optional. LogViewPlus requires all log entries to
follow the same schema, so optional fields are not fully supported. However, there is a work around. You can parse optional fields by using a
multi-pattern and progressing from most to least complicated scenario. Something like:
[%d{yyyy-MM-dd %H:mm:ss ZZZ}] %c.%p: %m [%S{Context}] %S{Detail}%n
[%d{yyyy-MM-dd %H:mm:ss ZZZ}] %c.%p: %m {%S{Detail}%n
[%d{yyyy-MM-dd %H:mm:ss ZZZ}] %c.%p: %m%n
Adding some context between the [], this would produce a grid like:
Hope that helps,
Toby