logstash/cookbook — pull request #46 by sgzijl (2013-03-13 20:33:10+00:00)
Title: Parse anacron on osfamily redhat too.

On the osfamily RedHat the anacron messages result in _grokparsefailures, e.g.:

Mar 13 15:01:01 hostname run-parts(/etc/cron.hourly)[3036]: starting mcelog.cron

By changing PROG to DATA in the grok pattern the issue seem to be solved, without breaking anything else.

Perhaps it's worth changing it permanently in the syslog_pri cookbook recipe?