telegraf GROK pattern matching issues

jlw52761

I have pfBlocker enabled with GEOIP blocking, and I've been able to get the DNSBL logs to parse and go into InfluxDB. The issue I'm h[0_1564446396094_sanatizedlogsample.csv](Uploading 0%) aving is I can't seem to get this to work for the ip_block.log and was hoping some GROK guru would be willing to give some advice.

I've used https://grokdebug.herokuapp.com/ and it says I have a valid GROK pattern, so not sure what I'm missing.

My telegraf.conf entry is as follows, with sample data (sanatizedlogsample.zip) attached.

[[inputs.logparser]]
  files = ["/var/log/pfblockerng/ip_block.log"]
  from_beginning=true
  [inputs.logparser.grok]
    measurement = "ipblock_log"
    patterns = ["^%{SYSLOGTIMESTAMP:timestamp},%{GREEDYDATA:tracker_id},%{WORD:interface},%{WORD:interface_name},%{WORD:action},%{WORD:ipversion},%{WORD:protocol_id},%{WORD:protocol},%{GREEDYDATA:src_ip},%{GREEDYDATA:dst_ip},%{GREEDYDATA:src_port>},%{GREEDYDATA:dst_port},%{WORD:dst_port_dir},%{WORD:country_code},%{WORD:alias_name},%{GREEDYDATA:ip_evaluated},%{WORD:feed_name},%{GREEDYDATA:resolved_hostname},%{WORD:client_hostname},%{WORD:asn},%{GREEDYDATA:hitormiss}"]
    timezone = "Local"
    [inputs.logparser.tags]
      value = "2"

The target is InfluxDB,not sure if that makes a difference or not.