I have a logstash integration with kibana and accesslogs are published to kibana dashboard.

Now i have some logs and some patterns to recognize these logs. Pattern has some filters defined in it, now i see that for some logs the filters gets recognized. For some logs the filters dont come up. Locally when i test with grok debugger, the pattern looks fine. What could be the issue?

Log for which pattern doesnt match

```
2015-07-31 04:02:40 0.001 377 GET /ics 302 - "1.00572FZnxXkFo2n_GlCCyf0005yG0008PD;kYjE0ZDLIPGDj9ROnG" - "10.242.5.120"

```

Pattern:

```
ICSACCESSTIMESTAMPSTRING %{DATE}    %{TIME}
ICSWLS_ACCESS_LOG_FM1 %{ICSACCESSTIMESTAMPSTRING:icswlsaccess-logtimestamp} %{NUMBER:icswlsaccess-timetaken:float}  %{NUMBER:icswlsaccess-bytes:int}    %{DATA:icswlsaccess-csmethod}   %{DATA:icswlsaccess-csurl}  %{NUMBER:icswlsaccess-cstatus:int}  "%{DATA:icswlsaccess-dmsecid}" "%{DATA:icswlsaccess-ecidcontext}"   %{DATA:icswlsaccess-proxyremoteuser}    %{GREEDYDATA:icswlsaccess-proxyclientip}

ICSWLS_ACCESS_LOG_FM2 %{ICSACCESSTIMESTAMPSTRING:icswlsaccess-logtimestamp}  %{NUMBER:icswlsaccess-timetaken:float}   %{NUMBER:icswlsaccess-bytes:int} %{DATA:icswlsaccess-csmethod}    %{DATA:icswlsaccess-csurl}       %{NUMBER:icswlsaccess-cstatus:int}       "%{DATA:icswlsaccess-dmsecid}"   %{DATA:icswlsaccess-ecidcontext}       %{DATA:icswlsaccess-proxyremoteuser}     %{GREEDYDATA:icswlsaccess-proxyclientip}

ICSWLS_ACCESS_LOG_FM3 %{ICSACCESSTIMESTAMPSTRING:icswlsaccess-logtimestamp} %{NUMBER:icswlsaccess-timetaken:float}  %{NUMBER:icswlsaccess-bytes:int}    %{DATA:icswlsaccess-csmethod}   %{DATA:icswlsaccess-csurl}  %{NUMBER:icswlsaccess-cstatus:int}  "%{DATA:icswlsaccess-dmsecid}"  "%{DATA:icswlsaccess-ecidcontext}"  %{DATA:icswlsaccess-proxyremoteuser}    %{GREEDYDATA:icswlsaccess-proxyclientip}

ICSWLS_ACCESS_LOG_FM4 %{ICSACCESSTIMESTAMPSTRING:icswlsaccess-logtimestamp} %{NUMBER:icswlsaccess-timetaken:float}  %{NUMBER:icswlsaccess-bytes:int}    %{DATA:icswlsaccess-csmethod}   %{DATA:icswlsaccess-csurl}  %{NUMBER:icswlsaccess-cstatus:int}  "%{DATA:icswlsaccess-dmsecid}"  %{DATA:icswlsaccess-ecidcontext}    %{DATA:icswlsaccess-proxyremoteuser}    %{GREEDYDATA:icswlsaccess-proxyclientip}

ICSWLS_ACCESS_LOG_FM5 #%{GREEDYDATA:logcomments}

ICSWLS_ACCESS_LOG %{ICSWLS_ACCESS_LOG_FM1}|%{ICSWLS_ACCESS_LOG_FM2}|%{ICSWLS_ACCESS_LOG_FM3}|%{ICSWLS_ACCESS_LOG_FM4}|%{ICSWLS_ACCESS_LOG_FM5}

```

One more example which i tried:
Sample message:

```
2015-08-12 13:20:48 0.002 377 GET /ics 302 - "1.0057HoLhIMPFo2n_GlCCyf0003TL000GHW;kYjE0ZDLIPGDj9ROnG" - "10.242.5.120"

```

Pattern:

```
ICSACCESSTIMESTAMPSTRING2 %{DATE} *%{TIME}

ICSWLS_ACCESS_LOG_FM6 %{ICSACCESSTIMESTAMPSTRING2:icswlsaccess-logtimestamp} *%{NUMBER:icswlsaccess-timetaken:float} *%{NUMBER:icswlsaccess-bytes:int} *%{DATA:icswlsaccess-csmethod} *%{DATA:icswlsaccess-csurl} *%{NUMBER:icswlsaccess-cstatus:int} *"%{DATA:icswlsaccess-dmsecid}" *"%{DATA:icswlsaccess-ecidcontext}" *%{DATA:icswlsaccess-proxyremoteuser} *%{GREEDYDATA:icswlsaccess-proxyclientip}

```