Filebeats to logstash _grokparsefailure, direct to ES is fine

I'm having issues sending syslog to logstash using filebeat, when logstash received the entry it produces a _grokparsefailure. However if I send directly to ES everything works fine.

My logstash config is and it includes an example log line that was sent by my beats prospector. I've tested the message against the grok pattern at and everything seems to be good.

Any help would be appreciated.


Ok, issue fixed.

I was trying to parse the files as though they had arrived via RELP, once I removed the grok statement completely the logs started parsing without issue.