title: Logstash filter correct in debugger but doesn't work when searching in kibana
body: <p>My logstash filter correct in debugger but doesn't show the fields when searching the exact message I tested with in kibana. Here is my filter:</p>
  
  <pre><code>filter {
  if [type] == "syslog" {
     grok {
       match =&gt; { 'message' =&gt; '%{SYSLOG5424LINE}' }
     }
     syslog_pri {
       syslog_pri_field_name =&gt; 'syslog5424_pri'
     }
     date {
       match =&gt; [ 'syslog5424_ts', 'ISO8601' ]
     }
  }
  </code></pre>
  
  <p>and here is an example of my log message:</p>
  
  <pre><code>&lt;134&gt;1 2017-01-23T10:54:44.587136-08:00 mcmp mapp  - -  close ('xxx', 32415)
  </code></pre>
  
  <p>It seems like the filter isn't applying, I restarted my logstash service and tested in the grok debugger. Any idea whats wrong?</p>