Ok, so I moved my groks from Ls1 to Ls2, but the mistake being that I didn't factor in that it was grok'ing on a modified bunch of text. In my troubleshooting, I opened a Kafka producer console and noted that the text was ending up in ES, which alluded to an issue with the grok. Wish I figured that out sooner!
Thanks for your reply, I appreciate you trying to help me.