Another possibility for those struggling with aws grok - the log files I was trying to crawl were in uft-16 LE BOM (just what the 3rd party system was creating) and grok would not work - changed the log files to utf-8 and it worked