That pattern, which is essentially what you are using, would match the kind of message I would expect to see on /var/log/syslog on a Solaris server. Those look like this:
May 11 10:40:48 scrooge disk-health-nurse[26783]: [ID 702911 user.error] m:SY-mon-full-500 c:H : partition health measures for /var did not suffice
But your message starts with a PRI, then has some number followed by a timestamp that appears to include a timezone name (unless you have a host called CET), which strikes me as rather not syslog.
Personally I would not even use grok for this. I think dissect is better (cheaper to run, easier to configure). With dissect I would use this (assuming CET is a timezone)
dissect { mapping => { "message" => "<%{pri}>%{}: %{ts} %{+ts} %{+ts} %{+ts}: %{syslog_message}" } }
date { match => [ "ts", "MMM d HH:mm:ss ZZZ" ] }
If you really want or need to use grok, start with something like this. If it really is a timezone you will need to glue it onto timestamp using mutate+add_field before parsing it using date.
"<%{NUMBER}>%{NUMBER}: %{SYSLOGTIMESTAMP:syslog_timestamp} %{WORD:timezoneorhost}: %{GREEDYDATA:syslog_message}"
Note that in your date filter, you do not need two formats. You have
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
The first one should not have two spaces before the d, since your timestamp field does not. You can use
match => [ "syslog_timestamp", "MMM d HH:mm:ss" ]
since that will match both "Apr 9 08:46:53" and "Apr 19 08:46:53". I hope that helps.