Logstash is not working properly. _grokparsefailure

strange behavior of the logstash, everything is parsed in the debugger, but not in the config - gives an error - _grokparsefailure
my logs,03/31/2023 15:02:05.465,sf_sap_put_mr.sap_put_mr_2Z,element,error,error.badfetch: request ( was timed out after 20000 milliseconds.

my config:

        else if ([message] =~ "error.badfetch:") {
                grok {
                        patterns_dir => ["/etc/logstash/conf.d/patterns"]
                        match => {"message" => "%{IP:ip}.%{IDCUST:id}.%{TEXCUST:app},%{TIMECUST:time},%{TEXCUST2:3rd_integration},%{TEXCUST:element},%{GREEDYDATA:fl},%{GREEDYDATA:msg}"}
                mutate {
                        add_tag => [ "badfetch" ]

and pattern

IDCUST \d+[^.].\d+[^.]
TIMECUST \d{2}/\d{2}/\d{4} %{TIME}
IP (?<![0-9])(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))(?![0-9])
TEXCUST [a-zA-Z0-9-_ ]+
TEXCUST2 [a-zA-Z0-9-_ .]+|

my screen debugger

what could be the reason for why it does not parse these logs, although in this de configuration else if everything works out well.

Is this not the first time I've encountered this? what could it be?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.