strip ES filter again to see if its causing the grok parse filter error