Custom pattern problems in the grok filter

[magnusbaeck (Magnus Bäck)]

For the record, this was sorted out here:

Get the right timestamp for old log files

Okay. You have a single grok filter with multiple expressions. With the default true value of break_on_match grok will stop once it gets a match. You need to disable that or split your multi-expression grok filter into two separate filters.