title: Grok pattern for tomcat logs gives compile error on Grok Debugger
body: <p>I am trying to setup ELK for a Java application. The tomcat logs are produced using log4j. To write a test a pattern, I am using <a href="http://grokdebug.herokuapp.com/" rel="nofollow" title="Grok Debugger">Grok Debugger</a>. But on the debugger it always shows </p>
  
  <blockquote>
    <p>Compile ERROR</p>
  </blockquote>
  
  <p>My log sample:</p>
  
  <pre><code>YYYY-MM-DD HH:MM:SS,SSS INFO : [so-me-uni-que-id] com.xx.xx.xx.xx.xx - log message here
  </code></pre>
  
  <p>My grok filter:</p>
  
  <pre><code>filter {   if [type] == "tomcat" {     grok {       match =&gt; { "message" =&gt; "%{TOMCATLOG}" }     }     date {       match =&gt; [ "timestamp", "yyyy-MM-dd HH:mm:ss,SSS" ]     } } }
  </code></pre>
  
  <p>My pattern:</p>
  
  <pre><code>TOMCATLOG %{TOMCAT_DATESTAMP:timestamp} \| %{LOGLEVEL:level} \| %{UNIQUEID:uniqueid}\| %{JAVACLASS:class} - %{JAVALOGMESSAGE:logmessage}
  </code></pre>