move grok pattern to its own dir
Add some tests for the grok pattern