Filebeats to logstash _grokparsefailure, direct to ES is fine

Elastic Stack Beats
1

I'm having issues sending syslog to logstash using filebeat, when logstash received the entry it produces a _grokparsefailure. However if I send directly to ES everything works fine.

My logstash config is http://pastebin.com/si3vPDcE and it includes an example log line that was sent by my beats prospector. I've tested the message against the grok pattern at https://grokdebug.herokuapp.com and everything seems to be good.

Any help would be appreciated.
Thanks.
jwh

mentioning:
@andrewkroh

2

Ok, issue fixed.

I was trying to parse the files as though they had arrived via RELP, once I removed the grok statement completely the logs started parsing without issue.