What is wrong in my grok filter work for logstash?