Grok in realtime fails but in Debuuger works happy

Elastic Stack Logstash
6

im sorry id didn't change im still getting "_grokparsefailure_sysloginput"
and all the fields are still in the "message" not sperated

These are all my conf files
input.conf output.conf and filter.conf

input {
syslog {
host => "x.x.x.x.x"
port => 514
codec => plain {
charset => "ISO-8859-1" }
}
}

output {
elasticsearch {
protocol => "http"
}
}

filter {
grok {
match => [
"message",
"<%{INT:syslog_pri}>%{GREEDYDATA:message}"
]
overwrite => "message"
}
kv { }
}