Logstash filter failing to match all instances

Elastic Stack Logstash
1

Some referrer fields are - and some are Direct Access. I've even tried deleting all the indexes and rerunning logstash, but I have the same problem. Any kind of help would be appreciated!

Logstash conf file:

input {
  file {
    path => "/var/log/nginx/access.log"
  }
}

filter {
  grok {
    match => {
      "message" => '%{IPORHOST:remote_ip} - %{DATA:user_name} \[%{HTTPDATE:time}\] "%{WORD:request_action} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:response} %{NUMBER:bytes} "%{DATA:referrer}" "%{DATA:agent}"'
    }
  }

  date {
    match => [ "time", "dd/MMM/YYYY:HH:mm:ss Z" ]
    locale => en
  }

  geoip {
    source => "remote_ip"
    target => "geoip"
  }

  useragent {
    source => "agent"
    target => "user_agent"
  }

  mutate {
    gsub => [
      "referrer", "-", "Direct Access"
    ]
  }


}

output {
  stdout { codec => rubydebug }

  elasticsearch {
    document_type => "log"
    template => "./web_access_template.json"
    template_name => "web_access"
    template_overwrite => true
  }
}

The template file:

{
  "template": "web_access",
  "settings": {
    "index.refresh_interval": "5s"
  },
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
        "message_field": {
          "mapping": {
            "index": "analyzed",
            "omit_norms": true,
            "type": "string"
          },
          "match_mapping_type": "string",
          "match": "message"
        }
      },
      {
        "string_fields": {
          "mapping": {
            "index": "analyzed",
            "omit_norms": true,
            "type": "string",
            "fields": {
              "raw": {
                "index": "not_analyzed",
                "ignore_above": 256,
                "type": "string"
              }
            }
          },
          "match_mapping_type": "string",
          "match": "*"
        }
      }
      ],
      "properties": {
        "geoip": {
          "dynamic": true,
          "properties": {
            "location": {
              "type": "geo_point"
            }
          },
          "type": "object"
        },
        "bytes": {
          "type": "float"
        },
        "request": {
          "index": "not_analyzed",
          "type": "string"
        }
      },
      "_all": {
        "enabled": true
      }
    }
  }
}
2

I've included the appropriate files. I'm still not sure why some referrer fields are - and some are Direct Access.