Thanks for the quick reply, even if I change the test012-fielt into "message" the output doesn´t change.
{
"@version" => "1",
"@timestamp" => 2018-05-09T09:40:53.305Z,
"host" => "192.168.88.3",
"tags" => [
[0] "_grokparsefailure"
],
"type" => "MikroTik",
"message" => "system,info,account user admin logged in from 192.168.88.1 via telnet"
}
Again the "_grokparsefailure"-tag