strange behavior of the logstash, everything is parsed in the debugger, but not in the config - gives an error - _grokparsefailure
my logs
10.10.10.10.1680263940261.385400.G_B2C_BETA,03/31/2023 15:02:05.465,sf_sap_put_mr.sap_put_mr_2Z,element,error,error.badfetch: request (http://10.10.10.10:7000/CVP/Server) was timed out after 20000 milliseconds.
my config:
else if ([message] =~ "error.badfetch:") {
grok {
patterns_dir => ["/etc/logstash/conf.d/patterns"]
match => {"message" => "%{IP:ip}.%{IDCUST:id}.%{TEXCUST:app},%{TIMECUST:time},%{TEXCUST2:3rd_integration},%{TEXCUST:element},%{GREEDYDATA:fl},%{GREEDYDATA:msg}"}
}
mutate {
add_tag => [ "badfetch" ]
}
}
and pattern
IDCUST \d+[^.].\d+[^.]
TIMECUST \d{2}/\d{2}/\d{4} %{TIME}
IP (?<![0-9])(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))(?![0-9])
TEXCUST [a-zA-Z0-9-_ ]+
TEXCUST2 [a-zA-Z0-9-_ .]+|
ALLCUST
my screen debugger
what could be the reason for why it does not parse these logs, although in this de configuration else if everything works out well.
Is this not the first time I've encountered this? what could it be?