I suspect you are using elastic ingest processor instead of logstash, can you clarify this?
You use custom patterns that seem related to ingest processors. I found these after a quick search:
The dot notation
log.level is not standard for logstash, bracket notation should be instead
Anyway, your last pattern doesn't work because
WORD pattern doesn't match
"filebeat-lasernet". You might use
A tool like grok constructor is more useful to test patterns as it shows what has and has not matched.
Having said that, if your logs start with a fixed number of bracket fields, it would make more sense to use the dissect filter (for logstash) or dissect processor. It should perform much better and you can forget about patterns.
If you really need to use grok, at least you can start your match patterns with an anchor to the begining of the line, it will perform somewhat better. You can find more information here: