Logstash grokparsefailure在日志存储配置中的某些过滤器之后

我有一些来自网络设备的日志。 日志发送到日志存储 在使用日志进行一些筛选之后，我得到了“grokparsefailure”

logstash形态

        grok {
                match => { "message" => "^[a-z0-9,]* %{GREEDYDATA:message}" }
                overwrite => [ "message" ]
        }

        multiline {
                source => "message"
                pattern => "^(TCP)|(first L2TP)"
                negate => false
                what => next
                max_age => "2"
        }
        mutate {
                gsub => ["message", "\n", " "]
        }
# message from susseful PPTP VPN client login
        if ( [message] =~ /^TCP.*(logged\sin,)/) {
                grok {
                        match => { "message" => " %{PPTPVPNCLIENTIN} " }
                        add_field => { "[microtik][vpnclientauth]" => "login susseful" }
                }
        }

格罗克模式

PPTPVPNCLIENTIN TCP connection established from %{IPV4:[microtik][vpnclientsourceip]} %{USERNAME:[microtik][username]} logged in, %{IPV4:[microtik][vpnclientinternalip]}

原木

"pptp,info TCP connection established from realIP"
"pptp,ppp,info,account username logged in, localIP"

rubydebug输出

{
       "message" => "TCP connection established from reaiIP username logged in, localIP",
      "@version" => "1",
    "@timestamp" => "date/time",
          "type" => "mtsl",
          "host" => "ip",
    },
          "tags" => [
        [0] "multiline",
        [1] "_grokparsefailure"
    ]
}

我认为这是我语法上的一个简单错误，但找不到它。

really simple）in string match=>{“message”=>“%{PPTPVPNCLIENTIN}}我忘记了在我的父亲之前和之后删除空格（一切正常））