filter {
  if [message] =~ /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun) / {
    grok {
      match => ['message', 'pattern1']
    }
  }
  ...
}