{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/4055","labels_url":"https://api.github.com/repos/elastic/logstash/issues/4055/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/4055/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/4055/events","html_url":"https://github.com/elastic/logstash/issues/4055","id":112008156,"number":4055,"title":"Grok failure (beta2)","user":{"login":"splitice","id":468579,"avatar_url":"https://avatars.githubusercontent.com/u/468579?v=3","gravatar_id":"","url":"https://api.github.com/users/splitice","html_url":"https://github.com/splitice","followers_url":"https://api.github.com/users/splitice/followers","following_url":"https://api.github.com/users/splitice/following{/other_user}","gists_url":"https://api.github.com/users/splitice/gists{/gist_id}","starred_url":"https://api.github.com/users/splitice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/splitice/subscriptions","organizations_url":"https://api.github.com/users/splitice/orgs","repos_url":"https://api.github.com/users/splitice/repos","events_url":"https://api.github.com/users/splitice/events{/privacy}","received_events_url":"https://api.github.com/users/splitice/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/logstash/labels/blocker","name":"blocker","color":"e11d21"},{"url":"https://api.github.com/repos/elastic/logstash/labels/bug","name":"bug","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-10-18T08:45:16Z","updated_at":"2015-10-19T09:41:32Z","closed_at":null,"body":"I did an upgrade of one node in our logstash cluster which was running beta1 to beta2 today. A very large issue could be immediately seen, all the matched fields appear to not be extracted correctly.\r\n\r\nHere is a screenshot from kibana.\r\n\r\n![19_41_08 1](https://cloud.githubusercontent.com/assets/468579/10563295/808e9f7e-75d0-11e5-8c41-c952603ac20d.png)\r\n\r\nThe only fields that work are those explicitly typed with the grok syntax ```{PATTERN:name:type}```. It would appear the start of the log message is being used, these log messages parsed start with ```[number] ....```.\r\n\r\nThis pattern and configuration worked fine with beta1.\r\n\r\nThis may be grok or core related so I am opening the bug here until cause identified. There doesnt seem to be any relevant commits in the plugin that I can see.\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/logstash/issues/comments/149164683","html_url":"https://github.com/elastic/logstash/issues/4055#issuecomment-149164683","issue_url":"https://api.github.com/repos/elastic/logstash/issues/4055","id":149164683,"user":{"login":"guyboertje","id":84912,"avatar_url":"https://avatars.githubusercontent.com/u/84912?v=3","gravatar_id":"","url":"https://api.github.com/users/guyboertje","html_url":"https://github.com/guyboertje","followers_url":"https://api.github.com/users/guyboertje/followers","following_url":"https://api.github.com/users/guyboertje/following{/other_user}","gists_url":"https://api.github.com/users/guyboertje/gists{/gist_id}","starred_url":"https://api.github.com/users/guyboertje/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guyboertje/subscriptions","organizations_url":"https://api.github.com/users/guyboertje/orgs","repos_url":"https://api.github.com/users/guyboertje/repos","events_url":"https://api.github.com/users/guyboertje/events{/privacy}","received_events_url":"https://api.github.com/users/guyboertje/received_events","type":"User","site_admin":false},"created_at":"2015-10-19T09:41:32Z","updated_at":"2015-10-19T09:41:32Z","body":"I have tested the full pipeline on the command line.  Confirm that issue exists."}}