Grok debugger works, on logstash not

[psyskeletor]

Hi there.

Super new to logstash.
I wanted to extract exit code from logs, so i came with this solution using grok debugger

filter {
     grok {
         match => { "message" => "(?<exit_code>\b[exit code ]\d+ \b)" }
 
    }
}

but when running logstash locally with stdin with this line:

gitlab-runner-eks WARNING: Job failed: command terminated with exit code 1

it returns me this error:

gitlab-runner-eks WARNING: Job failed: command terminated with exit code 1
{
          "tags" => [
        [0] "_grokparsefailure"
    ],
      "@version" => "1",
       "message" => "gitlab-runner-eks WARNING: Job failed: command terminated with exit code 1",
          "host" => {
        "hostname" => "computer"
    },
         "event" => {
        "original" => "gitlab-runner-eks WARNING: Job failed: command terminated with exit code 1"
    },
    "@timestamp" => 2023-05-09T12:05:43.472221Z
}

Any ideas what i am doing wrong?

[Badger]

I would sugggest

grok { match => { "message" => "exit code (?<exit_code>\d+)" } }

Edited to add ... or even

grok { match => { "message" => "exit code %{INT:exit_code}" } }

[psyskeletor]

@Badger

{ "message" => "exit code %{INT:exit_code}" }

Worked like a charm!

thanks a lot!