Grokparse failure - but grokdebugger works

[magnusbaeck (Magnus Bäck)]

also shouldn't you be matching on "message" field instead?
and how are you matchin

This should be fine because of codec => json.