title: Logstash grok custom pattern yields no fields
body: <p>Newbie alert!</p>
  
  <p>I have the following grok filter:</p>
  
  <pre><code>filter {
  
          grok {
                  match   =&gt;  [ "message","%{DATESTAMP:timestamp}" ]
                  match   =&gt;  [ "message", "(?&lt;number_after_timestamp&gt;[0-9]{8}\s\w+)"]
                  match   =&gt;  [ "message", "(?&lt;error_or_debug&gt;(ERROR|DEBUG))"]
                  match   =&gt;  [ "message", "(?&lt;first_part&gt;ORB\.thread\.pool.*(?=\s{2}))" ]
                  match   =&gt;  [ "message", "(?&lt;exception_class_name&gt;(?&lt;=\&lt;Exception class name\=\s).*?\&gt;)" ]
                  match   =&gt;  [ "message", "(?&lt;exception_message&gt;(?&lt;=\&lt;Exception message\=).*?(?=\&gt;))" ]
  
          }   
  
  
  }
  </code></pre>
  
  <p>Individually every one of those patterns matched exactly the chunk of text I need when tested using the grok debugger. In the grok debugger the named pattern name is used as the field and emitted just fine. However when I run this over the same log events I used in the grok debugger none of the data from the log event lines or the field names is emitted.</p>
  
  <p>For example the exception class name pattern yields:</p>
  
  <pre><code>{
      "exception_class_name": [
      [
        "com.ultatica.bd.exceptions.TTFException&gt;"
      ]
     ]
  }
  </code></pre>
  
  <p>But when run against the data from logstash command line -> not a sausage!</p>
  
  <p>Would really appreciate any help.</p>
  
  <p>Thanks</p>
  
  <p>The logfile is like this:</p>
  
  <pre><code>[30/09/14 23:07:15:195 BST] 00000043 SystemOut O ERROR 32109 Tue Sep 30 23:07:15 BST 2014 ORB.thread.pool : 2 webuser com.ultra.bd.services.UltraticoCustomerService.processRequest API getPerson  &lt;Exception class name= com.Ultratico.bd.exceptions.UCOException&gt; &lt;Exception message= e05CX432182S&gt; &lt;UCOException Error = 32109&gt;
  
  [30/09/14 23:07:15:200 BST] 00000043 SystemOut O ERROR 32109 Tue Sep 30 23:07:15 BST 2014 ORB.thread.pool : 2 webuser com.Ultratico.ecrm.framework.sessionHandler.UltraticoSessionHandler.execute  &lt;Exception class name= com.Ultratico.bd.exceptions.UCOException&gt; &lt;Exception message= e05CX432182S&gt; &lt;UCOException Error = 32109&gt;
  </code></pre>