如何用grok拆分log4j消息

Question

我的log4j消息已使用带有aix 7.2的rsyslog推送到Nagios。 我想将消息停止在“在oracle.sql ....”处。 我写如下的grok过滤器：

\[%{DATA:LOG_LEVEL}\] %{TIMESTAMP_ISO8601:timestamp} \[%{GREEDYDATA:MSG}\] %{DATA:LOGNAME} %{DATA:sessionid} \- %{GREEDYDATA:java_msg}

但它得到完整的消息，直到结尾:(如何拆分消息？

[ERROR] 2020-11-12 14:48:52,997 [WMQJCAResourceAdapter : 18] DATABASE {sessionId=1123863375} - Failed to read record 'ID9560' from 'F_USER_ABBREVIATION' . Returning null.
java.sql.SQLException: Invalid character encountered in

    at oracle.sql.CharacterSet.failUTFConversion(CharacterSet.java:2900) ~[ojdbc7.jar:12.1.0.1.0]
    at oracle.sql.CharacterSetAL32UTF8.toString(CharacterSetAL32UTF8.java:184) ~[ojdbc7.jar:12.1.0.1.0]
    at oracle.xdb.XMLType.processString(XMLType.java:3325) ~[xdb.jar:?]
    at oracle.xdb.XMLType.processThin(XMLType.java:3450) ~[xdb.jar:?]
    at oracle.xdb.XMLType.<init>(XMLType.java:1550) ~[xdb.jar:?]
    at com.temenos.t24.CACHE_READ_cl.lbl_LOAD_RECORD(Unknown Source) [EB_DataAccess.jar:R17_AMR.0 java 1.7.0_55-b13 compliant 1.7]*