Logstash grok parse error parsing log file

i try to parse my log and get these values looks like

interfaces => PP/0/P1/CPU0
timestamp => 2016-05-03 19:37:08.879
message => mp[1051]: %ROUTING-MP-5-INIT_PEER_UP_DOWN : MP peer down: : received socket disconnect notification

syslog input, as follows:

"message" => "<189>26739314: PP/0/P1/CPU0:May 3 19:37:08.879 : mp[1051]: %ROUTING-MP-5-INIT_PEER_UP_DOWN : MP peer down: : received socket disconnect notification \n",

with this config file:

     grok {
    match => {"message" => "{<%{POSINT:syslog_pri}>%{NUMBER:id}:%{SYSLOGBASE:interface}:% 
    {SYSLOGTIMESTAMP:syslog_timestamp}:%{GREEDYDATA:syslog_message}"} }

However, I am getting a grok prase failure, I am not sure what the problem is. cant seem to pin point the pattern that is causing the problem. Any thoughts/comments would be appreciated.

Have you tried using http://grokconstructor.appspot.com/do/match

If I copy paste your message field and grok patter into the window I get this result. You can see that the first two patterns matched, but nothing after that did. It looks to be breaking around the SYSLOGBASE tag.

This link has all of the GROK expression definitions.


SYSLOGBASE looks to start by looking for some kind of timestamp. The remaining text doesn't begin with that timestamp so it fails.

i have modify my pattern as below,

 grok {
  match => {"message" => "<%{POSINT:syslog_pri}>%{NUMBER:syslog_pid}: %{DATA:interface}:%{SYSLOGTIMESTAMP:syslog_timestamp}:%{GREEDYDATA:syslog_message}"}

it's work in http://grokconstructor.appspot.com/do/match
but get "[0] "_grokparsefailure"" when run logstash

Can you please tell me what happened ?
Any thoughts/comments would be appreciated.

It actually still showed as not fully matching for me.

If you look at your test line you can see that it has a space right after the timestamp, I don't see that on yours.
Add a space between the colon separating the two expressions.
%{SYSLOGTIMESTAMP:syslog_timestamp} : %{GREEDYDATA:syslog_message}

Once I made that change I now see: