Filebeat custom patterns

[vladtepes (Vlad)]

Greetings friends,

I am trying to make this approach work in ingest pipelines, but have stumbled upon a syntax error.
The grok pattern is valid from what I have tested:

When I try to use it in the ingest pipeline however it shows a bad string error. Have you guys tried it or maybe can spot the issue?

[vladtepes (Vlad)]

I have also tested all patterns individually and the result is also positive.

The filter, as I can see finds the 'bad string' in the first part:
(?%{MONTHNUM}/%{MONTHDAY}/%{YEAR} %{HOUR}:%{MINUTE}:%{SECOND}*?*)%{SPACE}%{PROG:sp_process} (%{BASE16NUM:sp_pid})
If I delete this, then there is no more bad string error.

Unfortunately my understanding of all the Grok nuances is still infantile. Can somebody maybe spot something not supported by the ingest pipeline?