So I added an if statement to the syslog output that filtered out all '_grokparsefailure' tagged messages and dumped them to a /var/log file per the article here.
It appears the ESX messages are being caught as well, which I find odd as I used the exact same grok filter on the very same ESX box before and it worked perfectly fine.
I'm not a grok expert, but I'm reading up on it now. Would this cause all messages to fail being sent to elasticsearch if the grok parsing fails?