title: logstash grok filter for logs with arbitrary attribute-value pairs
body: <p>(This is related to my other question <a href="https://stackoverflow.com/questions/31884094/logstash-grok-filter-for-custom-logs">logstash grok filter for custom logs</a> )</p>
  
  <p>I have a logfile whose lines look something like:</p>
  
  <pre><code>14:46:16.603 [http-nio-8080-exec-4] INFO  METERING - msg=93e6dd5e-c009-46b3-b9eb-f753ee3b889a CREATE_JOB job=a820018e-7ad7-481a-97b0-bd705c3280ad data=71b1652e-16c8-4b33-9a57-f5fcb3d5de92
  14:46:17.378 [http-nio-8080-exec-3] INFO  METERING - msg=c1ddb068-e6a2-450a-9f8b-7cbc1dbc222a SET_STATUS job=a820018e-7ad7-481a-97b0-bd705c3280ad status=ACTIVE final=false
  </code></pre>
  
  <p>I built a pattern that matched the first line:</p>
  
  <pre><code>%{TIME:timestamp} %{NOTSPACE:http} %{WORD:loglevel}%{SPACE}%{WORD:logtype} - msg=%{NOTSPACE:msg}%{SPACE}%{WORD:action}%{SPACE}job=%{NOTSPACE:job}%{SPACE}data=%{NOTSPACE:data}
  </code></pre>
  
  <p>but obviously that only works for lines that have the <code>data=</code> at the end, versus the <code>status=</code> and <code>final=</code> at the end of the second line, or other attribute-value pairs on other lines?  How can I set up a pattern that says that after a certain point there will be an arbitrary of <code>foo=bar</code> pairs that I want to recognize and output as attribute/value pairs in the output?</p>