My advice on debugging grok patterns can be found here.
In filebeat setting ignore_older to zero means to include everything. In logstash, setting ignore_older to zero means to exclude everything more than zero seconds old, which usually excludes everything.