i removed the grok pattern in the filter conf. Now i only have a small grok in the input conf
input {
syslog {
port => 5000
syslog_field => "syslog"
grok_pattern => "<%{POSINT:syslog_pri}>"
tags => "syslog"
add_field => {
"origin" => "syslog"
}
}
}
Now i´m only getting _grokparsefailure_sysloginput but still no syslog_pri in my log.