Grok in realtime fails but in Debuuger works happy

[tassa (tal)]

Hi
i have installed the suggested plugin
bin/plugin install logstash-input-syslog

But i still get the nusty message
"tags _grokparsefailure_sysloginput"