title: Getting Logstash _grokparsefailure though Grok Debugger throws no errors
body: <p>I try to parse Check Point firewall Syslog logs with logstash and grok.</p>
  
  <p>Example of a log entry:</p>
  
  <pre><code>&lt;190&gt;2015 Mar 19 12:40:55 fw1 &lt;60031&gt; User admin failed to login (wrong authentication) (Source IP:123.123.123.123 Via:HTTP)
  </code></pre>
  
  <p>I use this pattern:</p>
  
  <pre><code>&lt;%{POSINT:syslog_pri}&gt;%{YEAR} %{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:device} &lt;%{POSINT:status}&gt; User %{WORD:account} %{DATA:msg} (?:[(])%{DATA:msg1}(?:[)]) (?:[(])Source IP:%{IPV4:src} Via:%{WORD:protocol}(?:[)])
  </code></pre>
  
  <p>All fields are parsed well and show up in elasticsearch/kibana. The <a href="http://grokdebug.herokuapp.com/" rel="nofollow">Grok Debugger</a> works fine with this specific log/pattern combination. However, I keep receiving _grokparsefailure tags. Has anyone a hint how to get rid of them?  </p>
  
  <p>UPDATE: Here is my complete logstash configuration (most relevant part is the "Failed login" block):</p>
  
  <pre><code>input { 
      syslog {
          type =&gt; "syslog"
          port =&gt; 514
      }
  }
  
  filter {
      if [type] == "syslog" {
          geoip { source =&gt; "host" }  
  
          # Firewall rule fired
          if [message] =~ "packet" {
              grok {
                  match =&gt; [ "message", "&lt;%{POSINT:syslog_pri}&gt;%{YEAR} %{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:device} &lt;%{POSINT:status}&gt; %{WORD:activity} %{DATA:inout} (?:[(])%{DATA:msg}(?:[)]) Src:%{IPV4:src} SPort:%{POSINT:sport} Dst:%{IPV4:dst} DPort:%{POSINT:dport} IPP:%{POSINT:ipp} Rule:%{INT:rule} Interface:%{WORD:iface}" ]
              }
          } 
          # Failed login
          else if [message] =~ "failed" {
              grok {
                  match =&gt; [ "message", "&lt;%{POSINT:syslog_pri}&gt;%{YEAR} %{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:device} &lt;%{POSINT:status}&gt; User %{WORD:account} %{DATA:msg} (?:[(])%{DATA:msg1}(?:[)]) (?:[(])Source IP:%{IPV4:src} Via:%{WORD:protocol}(?:[)])" ]
              }
          }
          # Successful login/out
          else if [message] =~ "logged" {
              mutate {
                  add_field =&gt; [ "userlogged", "%{host}" ]
              }
              grok {
                  match =&gt; [ "message", "&lt;%{POSINT:syslog_pri}&gt;%{YEAR} %{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:device} &lt;%{POSINT:status}&gt; User %{DATA:account} %{WORD} %{WORD:action} (?:[(])Source IP:%{IPV4:src} Via:%{WORD:protocol}(?:[)])" ]
              }
          }
          else {
              grok {
                  match =&gt; [ "message",  "&lt;%{POSINT:syslog_pri}&gt;%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ]
              }
          }
      }   
  }
  
  output {
      elasticsearch {
          host =&gt; "localhost"
          protocol =&gt; "http"
      }
  }
  </code></pre>