0

I am facing grokparsefailure issue with my logs, when I try match them from http://grokdebug.herokuapp.com/ they are working fine.

Sample log: 

08/13/2015 07:08:11 AM - WARNING - MainProcess - 31186 - agentmgr.views.session - save_session - Agent client got connected 98aa75fe-0ea3-11e5-9329-02add7aa4bff

Grok Pattern: 

if [category] == 'celery-logs' {
  grok {
    patterns_dir => "/opt/logstash-1.4.2/patterns"
    match => [ "messagee", "%{CELERY}" ]
  }
}

I have created custom celery log in patterns folder with name celery below is the pattern

DATESTAMP_12HOUR %{DATESTAMP} (AM|PM)
CELERY %{DATESTAMP_12HOUR} - %{GREEDYDATA}

On log stash Page I am getting the logs like below

{"message":" 08/13/2015 07:08:11 AM - WARNING - MainProcess - 31186 -  agentmgr.views.session - save_session - Agent client got connected 98aa75fe-0ea3-11e5-9329-02add7aa4bff","category":"celery-logs","@version":"1","@timestamp":"2015-08-13T07:10:33.330Z","tags":["_grokparsefailure"]}

Please help me identify the problem.

Alcanzar
  • 16,985
  • 6
  • 42
  • 59
Narendra522
  • 167
  • 1
  • 5
  • 17

1 Answers1

2

This is a typo on your part -- your match statement has "messagee" when it should have "message".

Alcanzar
  • 16,985
  • 6
  • 42
  • 59