At the beginning, my pattern is not correct, so every record is
unmatched and shown in elasticsearch as a whole line instead of
separated rows.
Then I changed my pattern which passes the http://grokdebug.herokuapp.com/. Now I can not see any of my new records in elasticsearch. My elasticsearch only shows the "_grokparsefailure" tagged records.
Where are the matched ones? thx