title: Parsing error "_grokparsefailure" in LogStash
body: <p>At first I displayed the logs in Kibana from the syslog and it worked fine. I set it up according to the documentation. </p>
  
  <p>Now I've changed the source of the logs, now it retrieves logs from my web application and although Kibana still displays them kind of correctly, now there're the Tags "_grokparsefailure" which means that there's an error in parsing the logs.</p>
  
  <p>The current filter I have:</p>
  
  <pre><code>filter {
    if [type] == "syslog" {
      grok {
        match =&gt; { "message" =&gt; "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
        add_field =&gt; [ "received_at", "%{@timestamp}" ]
        add_field =&gt; [ "received_from", "%{host}" ]
      }
      syslog_pri { }
      date {
        match =&gt; [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
      }
    }
  }
  </code></pre>
  
  <p>How can I find out where the parsing error is? Is there an online service which would help me create a grok pattern for my new logs? Any other advice?</p>
  
  <p>UPDATE: the logs are in json.</p>