Logstash don't send to Elastcisearch when i use %{WORD:service} in grok

[fabueno (Bernard Fabien)]

Hi, I'm just "training" with grok pattern, and with this log file :

Apr 17 14:26:49 192.168.0.61 firewall 514865 11:12:13:14:15:16 abcd123|-=.>

If I do : grok { match => { ["message", "%{SYSLOGTIMESTAMP:date} %{IP:ip}"] }
}

It works. But if I add %{WORD:service} to the line, it stop working.

Why ?

[Badger]

What result do you get with this configuration?

input { generator { count => 1 message => 'Apr 17 14:26:49 192.168.0.61 firewall 514865 11:12:13:14:15:16 abcd123' } }

filter { grok { match => ["message", "%{SYSLOGTIMESTAMP:date} %{IP:ip} %{WORD:service}"] } }