Perhaps share a few log lines and the groks... Maybe we can help tune,
Or sometimes breaking down a line with dissect first then grok the rest can help.
Or grok a part of it with the rest in GREEDYDATA (or not see below) then use one of the fields from the first grok as an identifier for more specific groks...
I.e Break it down with iterations.
Just a thought.
I'm not a regex expert though.