How to write grok expression for such log strings?

[Akshay]

My app logs are as shown below:

[2024-10-21 08:30:02] uat.INFO: Creating fake logs for testing purposes {"hostname":"my-host-6f5blah599-9p9kb","ip":"190.168.19.251","performance":29.680236}

[2024-10-21 08:33:57] uat.INFO: Creating simple fake logs for testing purposes

I am trying to write a GROK expression like:

\[%{TIMESTAMP_ISO8601:log_timestamp}\] %{WORD:app_environment}.%{LOGLEVEL:log_level}: %{GREEDYDATA:message}[\s]?{%{GREEDYDATA:context}}

However it matches only the first line and not the second. How can I tweak it so that it can parse both the log lines?

[pablo]

@Akshay Are you going to use it in Logstash?

[Akshay]

Nope. I want to use it in data-prepper.

[pablo]

@Akshay Have you tried this approach?

processor:
  - grok:
        match:
          message: [<first pattern>]
  - grok:
        match:
          message: [<second pattern>]