Grok parse failures .. Grok syntax

[Makra (Makara)]

Yeah that may be the case, i have also able to parse without any _grokparsefailure with the following grok.

filter {

          grok {

                  match => { "message" => '\[%{TIMESTAMP_ISO8601:timestamp}\] %{HTTPDUSER:EVENTUSER} %{WORD:EVENT} \[%{NUMBER:ID}:%{GREEDYDATA:STATE}\] %{GREEDYDATA:project} %{HTTPDUSER:USER}/ %{HTTPDUSER:abortedby} "%{GREEDYDATA:PATH}/%{GREEDYDATA:jobName}"\[%{GREEDYDATA:uuid}\]' }

          }

}

[Album] Imgur

[ranganath_nangineni]

@Makra

%{HTTPDUSER:abortedby}

The problem was with the spacing at this %{HTTPDUSER:abortedby}. This should be without any spaces to the adjacent /.