To make things easy to debug:
This is actually the http://grokdebug.herokuapp.com but that shows you the issue. How should grok know which is the correct pattern, if one already matches?
That type of patterns can not work in current GROK implementations. It might be in the past - but not in current ones.