I suspect this is because you have not configured this as an [array of index patterns](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match) as described in the docs. As the first pattern seems to match anything the second one does, you might actually be able to simply remove the second pattern.

---