Filebeat Syslog dashboard cannot be loaded if the grok expressions cannot be matched to a pattern.

[bohyun-e]

Using 5.3 on Mac OS X

Running the system Filebeat module, all of my syslogs fail to match the expected message pattern. The built-in syslog dashboard does not load as a result of this.

This is the expected pattern:
"patterns": [ """%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{SYSLOGHOST:system.syslog.hostname} %{DATA:system.syslog.program}(?:\[%{POSINT:system.syslog.pid}\])?: %{GREEDYMULTILINE:system.syslog.message}"""

Per @andrewkroh, to reproduce, run the following POST request:

POST _ingest/pipeline/filebeat-5.3.0-system-syslog-pipeline/_simulate { "docs": [ { "_source": { "message": "Apr 4 03:39:57 --- last message repeated 1 time ---" } } ] }

From the built-in dashboard, there are absolutely no errors exposed and the user does not immediately know why the Filebeat module is not working. Just by glimpsing at Discover tab in Kibana, it seems like everything is working but combined with the issue #3912, the user does not get any warnings or error messages exposed from Kibana dashboard or from the Filebeat logs (the logs report no errors)

cc: @tsg

[tsg]

The Grok error should be fixed by the above PR. I didn't have any other errors when running against your log file.