Why not recognize simple syslog text as SYSLOGLINE in Grok Debugger?

[patsevanton (Anton Patsev)]

Hello!

Source log:
Mar 16 00:01:25 evita postfix/smtpd[1713]: connect from camomile.cloud9.net[168.100.1.3]

Grok pattern - SYSLOGLINE

Output - No Matches

Screenshot:

[Badger]

I cannot speak to herokuapp.com, but it works in logstash

input { generator { count => 1 lines => [ 'Mar 16 00:01:25 evita postfix/smtpd[1713]: connect from camomile.cloud9.net[168.100.1.3]' ] } }
filter { grok { match => { "message" => "%{SYSLOGLINE}" } } }

produces

 "timestamp" => "Mar 16 00:01:25",
   "message" => [
    [0] "Mar 16 00:01:25 evita postfix/smtpd[1713]: connect from camomile.cloud9.net[168.100.1.3]",
    [1] "connect from camomile.cloud9.net[168.100.1.3]"
],
 "logsource" => "evita",
   "program" => "postfix/smtpd",

[patsevanton (Anton Patsev)]

Yes.. i forgot. Right %{SYSLOGLINE}.
Thanks!