Try this in your cfg file:
METRICS = [
{
match => '^.*(ERR\_\d{3}\_\d{3}\_\d{4}).*$',
metricType => 'IntAverage',
metricName => '$1|MessageCount_Error',
metricValue => '$CURRENTCOUNT'
},
{
match => '\d{3}\-\d{2}\-\d{2}\s\d{2}\:\d{2}:\d{2}\,\d{3}\sERROR\s(\w+)\s\-err\_code\:(ERR\_\d{3}\_\d{3}\_\d{4})\~referenceId\:\~sessionId\:\w+$',
metricType => 'StringEvent',
metricName => '$2|Error_Message',
metricValue => '$1'
},
{
match => '(\d{3}\-\d{2}\-\d{2})\s\d{2}\:\d{2}:\d{2}\,\d{3}\sERROR\s\w+\s\-err\_code\:(ERR\_\d{3}\_\d{3}\_\d{4})\~referenceId\:\~sessionId\:\w+$',
metricType => 'StringEvent',
metricName => '$2|Date',
metricValue => '$1'
},
{
match => '\d{3}\-\d{2}\-\d{2}\s(\d{2}\:\d{2}:\d{2}\,\d{3})\sERROR\s\w+\s\-err\_code\:(ERR\_\d{3}\_\d{3}\_\d{4})\~referenceId\:\~sessionId:\w+$',
metricType => 'StringEvent',
metricName => '$2|Time',
metricValue => '$1'
},
{
match => '^\d{3}\-\d{2}\-\d{2}\s\d{2}\:\d{2}:\d{2}\,\d{3}\sERROR\s\w+\s\-err\_code\:(ERR\d{3}\_\d{3}\_\d{4})\~referenceId\:\~sessionId:(\w+)$',
metricType => 'StringEvent',
metricName => '$1|sessionId',
metricValue => '$2'
},
]