Grok filter throwing error for valid pattern

GREEDYDATA may just be too greedy to be used here.

Are all of the fields you want to capture separated by the backslash-t sequence, or is it possible to have a backslash-t inside a captured field? Do you always have the same number of fields?

You may be better off using the dissect filter, which cares a lot more about what separates the fields than the exact patterns of the fields themselves.