Grok in realtime fails but in Debuuger works happy

[magnusbaeck (Magnus Bäck)]

The grok filter isn't always the best choice. In this case use the kv filter.

filter {
  grok {
    match => [
      "message",
      "<%{INT:syslog_pri}>%{GREEDYDATA:message}"
    ]
    overwrite => "message"
  }
  kv { }
}