对于kibana上的一些日志，过滤器无法识别

我有一个与kibana的logstash集成，并且accesslogs被发布到kibana仪表板 .

现在我有一些日志和一些模式来识别这些日志 . 模式中定义了一些过滤器，现在我看到，对于某些日志，过滤器会被识别 . 对于某些日志，过滤器不会出现 . 当我使用grok调试器测试时，模式看起来很好 . 可能是什么问题？

记录哪种模式不匹配

2015-07-31 04:02:40 0.001 377 GET /ics 302 - "1.00572FZnxXkFo2n_GlCCyf0005yG0008PD;kYjE0ZDLIPGDj9ROnG" - "10.242.5.120"

图案：

ICSACCESSTIMESTAMPSTRING %{DATE}    %{TIME}
ICSWLS_ACCESS_LOG_FM1 %{ICSACCESSTIMESTAMPSTRING:icswlsaccess-logtimestamp} %{NUMBER:icswlsaccess-timetaken:float}  %{NUMBER:icswlsaccess-bytes:int}    %{DATA:icswlsaccess-csmethod}   %{DATA:icswlsaccess-csurl}  %{NUMBER:icswlsaccess-cstatus:int}  "%{DATA:icswlsaccess-dmsecid}" "%{DATA:icswlsaccess-ecidcontext}"   %{DATA:icswlsaccess-proxyremoteuser}    %{GREEDYDATA:icswlsaccess-proxyclientip}

ICSWLS_ACCESS_LOG_FM2 %{ICSACCESSTIMESTAMPSTRING:icswlsaccess-logtimestamp}  %{NUMBER:icswlsaccess-timetaken:float}   %{NUMBER:icswlsaccess-bytes:int} %{DATA:icswlsaccess-csmethod}    %{DATA:icswlsaccess-csurl}       %{NUMBER:icswlsaccess-cstatus:int}       "%{DATA:icswlsaccess-dmsecid}"   %{DATA:icswlsaccess-ecidcontext}       %{DATA:icswlsaccess-proxyremoteuser}     %{GREEDYDATA:icswlsaccess-proxyclientip}

ICSWLS_ACCESS_LOG_FM3 %{ICSACCESSTIMESTAMPSTRING:icswlsaccess-logtimestamp} %{NUMBER:icswlsaccess-timetaken:float}  %{NUMBER:icswlsaccess-bytes:int}    %{DATA:icswlsaccess-csmethod}   %{DATA:icswlsaccess-csurl}  %{NUMBER:icswlsaccess-cstatus:int}  "%{DATA:icswlsaccess-dmsecid}"  "%{DATA:icswlsaccess-ecidcontext}"  %{DATA:icswlsaccess-proxyremoteuser}    %{GREEDYDATA:icswlsaccess-proxyclientip}

ICSWLS_ACCESS_LOG_FM4 %{ICSACCESSTIMESTAMPSTRING:icswlsaccess-logtimestamp} %{NUMBER:icswlsaccess-timetaken:float}  %{NUMBER:icswlsaccess-bytes:int}    %{DATA:icswlsaccess-csmethod}   %{DATA:icswlsaccess-csurl}  %{NUMBER:icswlsaccess-cstatus:int}  "%{DATA:icswlsaccess-dmsecid}"  %{DATA:icswlsaccess-ecidcontext}    %{DATA:icswlsaccess-proxyremoteuser}    %{GREEDYDATA:icswlsaccess-proxyclientip}

ICSWLS_ACCESS_LOG_FM5 #%{GREEDYDATA:logcomments}

ICSWLS_ACCESS_LOG %{ICSWLS_ACCESS_LOG_FM1}|%{ICSWLS_ACCESS_LOG_FM2}|%{ICSWLS_ACCESS_LOG_FM3}|%{ICSWLS_ACCESS_LOG_FM4}|%{ICSWLS_ACCESS_LOG_FM5}

我尝试的另一个例子：示例消息：

2015-08-12 13:20:48 0.002 377 GET /ics 302 - "1.0057HoLhIMPFo2n_GlCCyf0003TL000GHW;kYjE0ZDLIPGDj9ROnG" - "10.242.5.120"

图案：

ICSACCESSTIMESTAMPSTRING2 %{DATE} *%{TIME}

ICSWLS_ACCESS_LOG_FM6 %{ICSACCESSTIMESTAMPSTRING2:icswlsaccess-logtimestamp} *%{NUMBER:icswlsaccess-timetaken:float} *%{NUMBER:icswlsaccess-bytes:int} *%{DATA:icswlsaccess-csmethod} *%{DATA:icswlsaccess-csurl} *%{NUMBER:icswlsaccess-cstatus:int} *"%{DATA:icswlsaccess-dmsecid}" *"%{DATA:icswlsaccess-ecidcontext}" *%{DATA:icswlsaccess-proxyremoteuser} *%{GREEDYDATA:icswlsaccess-proxyclientip}