OK I have done a clean install of filebeat.
I've configured it to talk to my elasticsearch node.
I cloned the nginx module. Replacing all nginx refs to adblock.
I enabled the new module in /etc/filebeat/modules.d
The ONLY module enabled is my new one. I know it is working because the logs clearly show it's ingesting /var/log/nginx/adblock_access.log. And I see the documents in kibana.
I modified default.json to include my pattern. And double checked adblock has replaced nginx everywhere.
But I still get a grok error. And again the grok error does not occur when I test it with devtools.