Problem
Let's say you have a GRIB message M1 with 5 keys in its MARS namespace: stream, step, levtype, levelist and param. And another message M2 has 4 MARS keys: stream, step, levtype, param.
grib_ls works by taking the keys in the namespace of the first message and uses those same keys for all subsequent messages. So it will display those keys in the first row of its output.
What happens when these two messages are in the same file? If M1 comes before M2, grib_ls will ask all messages for the levelist key. Since M2 doesn't have it, you get "not_found".
If M2 had come before M1, then you would not see levelist at all since it is not in the first message's MARS namespace.
This can be overcome with the use of the "-j" option to grib_ls