logstash filter 为什么不成功

[2017-08-16T10:07:31,815][DEBUG][logstash.pipeline ] filter received {"event"=>{"@timestamp"=>2017-08-16T02:07:31.809Z, "port"=>59524, "@version"=>"1", "host"=>"127.0.0.1", "message"=>"20170815202020 GS_1_1 [Test] [Debug]I am Chuck Norris! \r"}}
[2017-08-16T10:07:31,816][DEBUG][logstash.filters.grok ] Running grok filter {:event=>2017-08-16T02:07:31.809Z 127.0.0.1 20170815202020 GS_1_1 [Test} [Debug]I am Chuck Norris!
[2017-08-16T10:07:31,818][DEBUG][logstash.filters.grok ] Event now: {:event=>2017-08-16T02:07:31.809Z 127.0.0.1 20170815202020 GS_1_1 [Test] [Debug}I am Chuck Norris!
[2017-08-16T10:07:31,820][DEBUG][logstash.pipeline ] output received {"event"=>{"@timestamp"=>2017-08-16T02:07:31.809Z, "port"=>59524, "@version"=>"1", "host"=>"127.0.0.1", "message"=>"20170815202020 GS_1_1 [Test] [Debug]I am Chuck Norris! \r", "tags"=>["_grokparsefailure"]}}

我的日志是message里面的，为什么不成功
grok {
13 patterns_dir => ["./config/grok.patterns"]
match => { "message" => "%{DATESTAMP_EVENTLOG:logtime} %{IDENTIFY:identify} [%{WORD:logtype}] [%{LOGLEVEL:loglevel}]%{DATA:text}" }
}

IDENTIFY [a-zA-Z]{2}_[0-9]_[0-9]