_grokparsefailure_syslog but grok filter perfectly from stdin

Elastic Stack Logstash
1

Hi!

I have little problem with Logstash 1.5.2 and grok filtering.. My Logstash get messages from syslog and grok have problems with one of them - it is adding _grokparsefailure_syslog tag. When I put message to stdin everything goes well. Here is grok filter rule:

"message" => ["USER_DN=\"CN=%{WORD:firstname} %{WORD:lastname}", "JOB_ID_LIST=\"CREAM%{NUMBER:cream_id}", "AbsJobId=slurm\/%{NUMBER}\/%{NUMBER:job_id}"]

I'm using Java 1.8.0_45.
Any suggestions?

2

The syslog input uses grok internally, and that's what isn't matching (hence _grokparsefailure_syslog instead of _grokparsefailure). It seems the syslog input doesn't like what is sent to it, possibly because it's malformed.

3

The problem was with builtin syslog grok filter. Now I'm using TCP input plugin and use own syslog grok filter which is working with specific message type.
Thanks! :slight_smile: