I can't reproduce what you're seeing.
$ cat test.config
input { stdin {} }
output { stdout { codec => rubydebug } }
filter {
grok {
match => [
"message",
"%{NUMBER:siteid};%{IP:usersip};%{TIMESTAMP_ISO8601:signdate}"
]
}
}
$ cat data
1;127.0.0.1;2014-06-22T12:32:35
$ /opt/logstash/bin/logstash -f test.config < data
Logstash startup completed
{
"message" => "1;127.0.0.1;2014-06-22T12:32:35",
"@version" => "1",
"@timestamp" => "2015-10-21T11:07:36.109Z",
"host" => "lnxolofon",
"siteid" => "1",
"usersip" => "127.0.0.1",
"signdate" => "2014-06-22T12:32:35"
}
Logstash shutdown completed