title: Logstash Grok Parsing Issue
body: <p>I am using Logstash to read some log file.
  Here are some data sources records</p>
  
  <pre><code>&lt;2016-07-07 00:31:01&gt;  Start
  &lt;2016-07-07 00:31:59&gt;  Warning - Export_Sysem 6 (1) =&gt; No records to be exported
  &lt;2016-07-07 00:32:22&gt;  Export2CICAP (04) =&gt; Export PO : 34 record(s)
  &lt;2016-07-07 00:32:22&gt;  Export2CICAP (04) =&gt; Export CO : 87 record(s)
  &lt;2016-07-07 00:32:22&gt;  Export2CICAP (04) =&gt; Export FC
  </code></pre>
  
  <p>This is my conf file</p>
  
  <pre><code>grok{
      match =&gt; {"message" =&gt; [
      '&lt;%{TIMESTAMP_ISO8601:Timestamp}&gt; (%{WORD:Level} - )%{NOTSPACE:Job_Code} =&gt; %{GREEDYDATA:message}',     
      '&lt;%{TIMESTAMP_ISO8601:Timestamp}&gt;  %{WORD:Parameter} - %{GREEDYDATA:Message}',
      '&lt;%{TIMESTAMP_ISO8601:Timestamp}&gt;  %{WORD:Status}',
      ]}
  }
  </code></pre>
  
  <p>This is part of my output</p>
  
  <pre><code>   {
         "message" =&gt; "??2016-07-07 00:31:01&gt;  Start\r?",
        "@version" =&gt; "1",
      "@timestamp" =&gt; "2016-07-08T03:22:01.076Z",
            "path" =&gt; "C:/CIGNA/Export.log",
            "host" =&gt; "SIMSPad",
            "type" =&gt; "txt",
            "tags" =&gt; [
          [0] "_grokparsefailure"
      ]
  }
  {
         "message" =&gt; "&lt;2016-07-07 00:31:59&gt;  Warning - Export_Sysem 6 (1) =&gt; No records to be exported\r?",
        "@version" =&gt; "1",
      "@timestamp" =&gt; "2016-07-06T16:31:59.000Z",
            "path" =&gt; "C:/CIGNA/Export.log",
            "host" =&gt; "SIMSPad",
            "type" =&gt; "txt",
       "Timestamp" =&gt; "2016-07-07 00:31:59",
       "Parameter" =&gt; "Warning",
         "Message" =&gt; "Export_Sysem 6 (1) =&gt; No records to be exported\r?"
  }
  {
         "message" =&gt; "&lt;2016-07-07 00:32:22&gt;  Export2CICAP (04) =&gt; Export CO : 87 record(s)\r?",
        "@version" =&gt; "1",
      "@timestamp" =&gt; "2016-07-06T16:32:22.000Z",
            "path" =&gt; "C:/CIGNA/Export.log",
            "host" =&gt; "SIMSPad",
            "type" =&gt; "txt",
       "Timestamp" =&gt; "2016-07-07 00:32:22",
          "Status" =&gt; "Export2CICAP"
  }
  </code></pre>
  
  <p>As seen from the output, <strong>the first output message has a grok parsing error and the other 2 outcomes did not fully parse the message</strong>. How should I modify my grok statement so it can fully parse the message?</p>