Logstash grok regex bug?

Logstash grok regex match result is not same with Kibana Grok Debugger.
(I think Kibana Grok Debugger's result is correct.)

Is there my fault? or is it grok's bug?

Filebeat Config

- type: log
    - C:/filebeat/smtp.log
  multiline.pattern: 'SMTP Server: Originator'
  multiline.negate: true
  multiline.match: after
  multiline.flush_pattern: 'SMTP Server: Message'

Logstash Config

filter {
    grok {
        match => {
            "message" => "\[.*\] (?<timestamp>\d{4}-\d{2}-\d{2} (?:AM|PM) \d{2}:\d{2}:\d{2})  SMTP Server: Originator: (?<sender>.*?)\n(?<temp_receiver>(?:.*SMTP Server: Recipient: .*\n)+)(?:.*\n)*(?:.*SMTP Server: Message.*size (?<size>.*))"

Logstash Debug Output

Kibana Grok Debugger Result

How can I get a same result with kibana grok debugger in logstash grok?
plz, help me~

Please do not post pictures of text, just post the text.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.