logging - logstash: grok parse failure -

i have config file

input {   stdin {}    file {     type => "txt"     path => "c:\users\gck\desktop\logsatash_practice\input.txt"     start_position=>"beginning"   } }   filter {     grok {         match => [ "message", "%{date:timestamp} %{ip:client} %{word:method} %{word:text}"]       }     date {         match => [ "timestamp", "mmm-dd-yyyy-hh:mm:ss" ]         locale => "en"     } }  output {     file {         path => "c:\users\gck\desktop\logsatash_practice\op\output3.txt"     } } 

and lets input:

may-08-2015-08:00:00 55.3.244.1 hello

may-13-2015-13:00:00 56.4.245.2 world

after running it, message of: grokparse failure.

this output:

{"message":"may-08-2015-08:00:00\t55.3.244.1\thello\r","@version":"1","@timestamp":"2015-05-11t12:51:05.268z","type":"txt","host":"user-pc","path":"c:\users\gck\desktop\logsatash_practice\input.txt","tags":["_grokparsefailure"]}

{"message":"may-13-2015-13:00:00\t56.4.245.2\tworld\r","@version":"1","@timestamp":"2015-05-11t12:51:05.269z","type":"txt","host":"user-pc","path":"c:\users\gck\desktop\logsatash_practice\input.txt","tags":["_grokparsefailure"]}

what do wrong?

not less important- there guide sums filtering thing in clear way? elastic guides aren't detailed enough.

the date grok pattern defined this:

date %{date_us}|%{date_eu} 

date_us , date_eu in turned defined this:

date_us %{monthnum}[/-]%{monthday}[/-]%{year} date_eu %{monthday}[./-]%{monthnum}[./-]%{year} 

i continue, it's clear doesn't match actual content of log message sample:

may-08-2015-08:00:00 55.3.244.1 hello 

there's no stock grok pattern matches date format it's easy put custom one. also, note separator between tokens in log messages aren't spaces tabs. can use \s match whitespace character. working example:

(?<timestamp>%{word}-%{monthday}-%{year}-%{time})\s%{ip:client}\s%{word:method}\s%{word:text} 

not less important- there guide sums filtering thing in clear way? elastic guides aren't detailed enough.

with exception of grok-specific %{pattern_name:variable} notation plain regular expressions, , there many introductory guides elsewhere.