I verified this in filebeat with the message you gave and grok pattern failed. The reason why it failed is because the \"\\x03\" part in the log message. Could you give more information on what \"\\x03\"is please? I see in some access log example, after the timestamp, it follows with the http request method. It would be helpful if we know what's \"\\x03\" in this case. Thanks!