Grok debug

b.conf

input { stdin {} }
filter {
  grok {
    match => [ "message", "\[%{RUBY_LOGLEVEL:loglevel}\] %{TIMESTAMP_ISO8601:logdate} %{ISO8601_TIMEZONE:timezone} \[%{NOTSPACE:somefield}\] \[%{IP:ipaddress}\] %{GREEDYDATA:therest}" ]
  }
  mutate {
    gsub => [ "logdate", "\ ", "T" ]
    replace => { "logdate" => "%{logdate}%{timezone}" }
  }
  date {
    match => [ "logdate", "ISO8601" ]
    remove_field => [ "logdate", "timezone" ]
  }
}
output {
  stdout { codec => rubydebug }
}

output.txt

$ bin/logstash -f b.conf
[INFO] 2014-03-24 06:28:32 +0000 [101fb7dcb4e8cc8f8479e6972b3ff756] [14.141.125.250] Completed 200 OK in 43ms (Views: 2.2ms | ActiveRecord: 2.1ms)
{
       "message" => "[INFO] 2014-03-24 06:28:32 +0000 [101fb7dcb4e8cc8f8479e6972b3ff756] [14.141.125.250] Completed 200 OK in 43ms (Views: 2.2ms | ActiveRecord: 2.1ms)",
      "@version" => "1",
    "@timestamp" => "2014-03-24T06:28:32.000Z",
          "host" => "aironaut-wired.untergeek.net",
      "loglevel" => "INFO",
     "somefield" => "101fb7dcb4e8cc8f8479e6972b3ff756",
     "ipaddress" => "14.141.125.250",
       "therest" => "Completed 200 OK in 43ms (Views: 2.2ms | ActiveRecord: 2.1ms)"
}