title: Logstash '_grokparsefailure' issue
body: <p>I am using custom grok pattern to parse my log file, Not matter what i do it always give me the <em>_grokparsefailure</em> exception.</p>
  
  <p>However, it work perfectly on <a href="https://grokdebug.herokuapp.com/" rel="nofollow">https://grokdebug.herokuapp.com/</a></p>
  
  <p>My custom pattern file is located at,</p>
  
  <blockquote>
    <p>C:\Users\Username\projects\Logstash\bin\patterns</p>
    
    <p>Filename: mylogpattern</p>
  </blockquote>
  
  <pre><code>    LogLevel [I|V|D|M|W|E|A|F]
      MODULE \b\w+\b|------
      MESSAGEID (?:[+-]?(?:[0-9]+))|----
      SUBMODULE (.*?:)
      MESSAGE (.*)|(.*?:)|(.*\s*?:)
  </code></pre>
  
  <p>My Logstash Config File Looks like this:</p>
  
  <pre><code>input{
      beats{
        host =&gt; "192.168.56.1"
        port =&gt; 7088
        congestion_threshold =&gt; 200
      }
  }
  filter {
      if [type] == "MyLog"{
          grok{
            patterns_dir =&gt; ["C:\Users\Username\projects\Logstash\logstash\bin\patterns"]
            match =&gt; { "message" =&gt; "%{YEAR:Year}%{MONTHNUM:Month}%{MONTHDAY:Day} %{HOUR:Hour}%{MINUTE:Minute}%{SECOND:Second} %{LogLevel:LogVerbosity} %{MODULE:MODULENAME}%{SPACE}%{MESSAGEID:MESSAGEID} %{SUBMODULE:SUBMODULE} %{MESSAGE:MESSAGE}" }
            add_field =&gt; [ "received_at", "%{@timestamp}" ]
            add_field =&gt; [ "received_from", "%{host}" ]
          }
      }  
  }
  output {
      elasticsearch {
        hosts =&gt; ["http://localhost:9200"]
        manage_template =&gt; false
        index =&gt; "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        document_type =&gt; "%{[@metadata][type]}"
      }
  }
  </code></pre>
  
  <p>Sample Log File:</p>
  
  <blockquote>
    <p>20160509 115108 I GEN    0000 ConnectionHandler.reconnect: Reconnect
    to the DB was done.</p>
    
    <p>20160509 115108 I GEN    0000 84.1.3.1000012 : Reconnect to the DB was
    done.</p>
  </blockquote>
  
  <p>It works perfectly on grok debugger, but somehow it is failing while parsing.</p>
  
  <pre><code>tags:beats_input_codec_plain_applied, _grokparsefailure 
  </code></pre>
  
  <p>Could someone please help me out with this, What am I doing wrong?</p>
  
  <p><strong>EDIT 1 :</strong></p>
  
  <p>I can see, for first few seconds, Logs are getting parsed. But , After that it is throwing the error.</p>
  
  <p>All log follows essentially the same format, also i have added GREEDYDATA filter for the long messages, it is able to parse it successfully. I can still see some parsed logs in kibana.</p>
  
  <p>Its just the log count is really high and log file also have continuous blank lines in between.</p>
  
  <p>Does it try to parse those blank lines as well ?</p>