Works fine here:
$ cat test.config
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
grok {
match => [
"message",
"%{WORD:NOM_BATCH}-%{BASE16NUM:DATE_JOURNEE_BATCH}-%{BASE16NUM:DATE_EXECUTION_BATCH}-%{BASE16NUM:HEURE_EXECUTION_BATCH}"
]
}
}
$ cat data
* /data/EDT/batchs/files/logs/WKF998MT-20180427-20180428-0122.log *
$ /opt/logstash/bin/logstash -f test.config < data
Settings: Default pipeline workers: 8
Pipeline main started
{
"message" => "* /data/EDT/batchs/files/logs/WKF998MT-20180427-20180428-0122.log *",
"@version" => "1",
"@timestamp" => "2018-07-02T14:07:42.149Z",
"host" => "lnxolofon",
"NOM_BATCH" => "WKF998MT",
"DATE_JOURNEE_BATCH" => "20180427",
"DATE_EXECUTION_BATCH" => "20180428",
"HEURE_EXECUTION_BATCH" => "0122"
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}
If you do exactly the same thing as above on your setup, what happens? If that works maybe there's some other filter that you have that's creating the problems?