Grokparsefailure, but works in grok debugger

Elastic Stack Logstash
1

Hey guys, need some help with grok, kind of at a loss. I've used Logstash quite a bit in the past, never run into this issue. On Logstash v2.2.2, I can't seem to get grok to parse some logs from Nginx. They have some custom fields added, but as mentioned in the title, the pattern I have works fine in https://grokdebug.herokuapp.com/.

Here is a sample message and my logstash config:
http://pastebin.com/VfU7iB6B

Any ideas?

2

The standard advice is to start with the very simplest grok expression, in your case just %{URIHOST}, and verify that that works. If so, add the next token and try again. At some point things are going to start failing and then you should be able to narrow down where the error is.

3

Thanks magnus, I completely forgot about doing it that way. Got it sorted out!