partial working grok for sshd syslogs shipped with lumberjack

10-syslog.conf

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}"}
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "event_time", "%{time}"]
      add_field => [ "received_from", "%{host}" ]
      add_field => ["logdate","%{month} %{day} %{time}"]
      remove_field => ["month","day", "time"]
      remove_field => ["syslog_pid"]
    }
if [syslog_program] == "sshd" {
      grok {
        add_tag        => ["sshd"]
        remove_tag => ["_grokparsefailure"]
      }
if [syslog_program] == "sshd"{
        if [event_time] >= "17:30" or [event_time] <= "07:30" {
                mutate{ add_tag => ["not_normal_traffic","alert"]}
                }
}
if [syslog_hostname] == "***" {
        mutate {remove_tag => ["not_normal_traffic","alert"]}
}
if "sshd" not in [tags]{
        grok {
                 patterns_dir   => ["/etc/logstash/patterns.d"]
                 match   => ["message", "%{SSHD_FAILED}"]
                 add_tag => ["sshd","ssh-failed-login"]
                 remove_tag => ["_grokparsefailure"]
        }
}
if "sshd" not in [tags] {
        grok {
          patterns_dir   => ["/etc/logstash/patterns.d"]
          match          => ["message", "%{SSHD_ACCEPTED}"]
          add_tag        => ["sshd","accepted-connection"]
          tag_on_failure => []
          remove_tag => ["_grokparsefailure"]
        }
      }
if "sshd" not in [tags] {
        grok {
          patterns_dir   => ["/etc/logstash/patterns.d"]
          match          => ["message", "%{SSHD_INVALID_USER}"]
          match          => ["message", "%{SSHD_INVALID_USER_AUTH}"]
          add_tag        => ["sshd","invalid-user"]
          tag_on_failure => []
          remove_tag => ["_grokparsefailure"]
        }
      }
 
 
      # etc ....
      # If we didn't match any of the above... we tag it as being unmatched.
      if "sshd" not in [tags] {
        mutate {
          add_tag    => ["sshd"]
          remove_tag => ["_grokparsefailure"]
        }
              }
syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
          }
 
    }
  }
}